User IDs that have been deactivated or have expired are never given to another person. This edition numbers the control A.11.9 (it was A.11.10 in 2019). 2019 guidance, not confirmed for this edition: the customer may handle some or all user ID management for its own users.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.