# Sign out and end session

**Flow key:** `sign-out-session-end`

## Outcome

The intended session or sessions become unusable, sensitive state is cleared, and navigation cannot resurrect authenticated content.

## Actors

- Authenticated user
- Identity/session service
- Other active devices or sessions

## Preconditions and entry points

- At least one active session exists.
- Protected and cached pages are known.
- Single-session versus all-session behavior is identified.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Sessions | current browser session plus second synthetic device | single, many, remembered, API token, impersonation session |
| Unsaved state | edited synthetic profile field | none, autosaved, upload in progress, payment/approval in progress |
| Cached content | one protected detail page | browser back/forward cache, downloaded file, service worker cache |
| Policy | sign out current session | sign out all devices, admin revocation, timeout |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | From an authenticated page, invoke Sign out. | The action names its scope and handles unsaved work according to policy. |
| 2 | Confirm if confirmation is required. | The server invalidates the intended session before presenting success. |
| 3 | Observe the signed-out destination. | Identity-specific data, navigation, and notifications are removed. |
| 4 | Use back, forward, refresh, and a copied protected URL. | No protected data or action is available from the ended session. |
| 5 | Attempt reuse of session cookies/tokens. | The server rejects revoked credentials. |
| 6 | Check unaffected sessions when scope is current-only. | Only the declared sessions remain active. |

## Alternate paths

- Current session only
- All devices
- Automatic idle/absolute timeout
- Admin/security revocation
- Sign out during an in-progress operation

## Failure and recovery paths

- Network fails during logout
- Client clears local state before server revocation
- Cached protected content remains visible
- Refresh token can recreate the session
- Parallel request commits after revocation

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [session lifecycle](../../items/identity/session-lifecycle.md)
- [run start stop cancel](../../items/actions/run-start-stop-cancel.md)
- [privacy](../../items/quality/privacy.md)
- [security](../../items/quality/security.md)

[Back to Identity and access flows](index.md)
