Authentication Testing: Credential and Session Lifecycles

Model authentication states across login, MFA, recovery, expiry, replay, and revocation; separate policy gaps from confirmed failures.