The control system shall end a remote session automatically once a configurable inactivity period has passed, or when the user who started it closes it by hand. The ISAGCA paper describes it as an SL 2 addition that removes idle remote sessions an attacker could hijack.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.