How should teams decide when to retire long-lived privileged access?

Teams should retire long-lived privileged access when the task can be completed through ephemeral sessions, scoped authorisation, and session logging instead. If the access is only needed briefly, keeping a permanent credential alive adds risk without adding value. The decision should be driven by task duration, ownership clarity, and revocation speed.