data class SessionPolicy(val maxAuthenticatedSessions: Int = DEFAULT_MAX_AUTHENTICATED_SESSIONS)
Concurrent-session cap. One access tier -- every session is equivalent, so the old CONTROL/ADMIN-specific caps are gone; maxAuthenticatedSessions alone still bounds total live sessions.