Require two-step sign-in, limit session age and idle time, shorten the re-authentication window.

Organization admins only (403 organization_admin_required). Signed in, with a fresh proof in the x-50h-reauth header (401 reauth_required); with an API key, a connected app or a service account, with the scope named here and no proof, where the organization has machine identities (otherwise 403 session_required). The key's or app's person must be an organization admin. Every change is written to the organization's audit, with who made it (a person, a key, an app or a service account). Policies apply to new and existing sessions: a session older than a new maximum ends on its next request (401 session_ended), and an OAuth refresh older than it answers invalid_grant. With two-step required, sensitive actions answer 403 two_step_required until the person adds two-step sign-in or a passkey; adding one is never blocked. Sends a policy.changed event.