The IED terminates an authenticated session after a configurable period of inactivity, on every access path, so that an unattended terminal or an abandoned remote session cannot be used by another person (2013's 5.1.8, now here).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.