A compromised role has active temporary sessions. The team updates its trust policy to block new assumptions. Why is further containment work needed?

1. Changing the role description revokes all active access tokens.
2. Every trust-policy update immediately deletes all temporary credentials worldwide.
3. Blocking new assumptions does not by itself invalidate already issued sessions; use appropriate session revocation controls.
4. Temporary credentials can never be restricted before natural expiration.