# Account session management — sign out everywhere

Kratos-native active-session management for the dashboard: list a user's active sessions (`GET /sessions` on Kratos public API) and revoke them — a single "Sign out of other sessions" action plus, optionally, per-session revoke. Surface as a card in dashboard **Settings → Security**, reusing the Ory-Elements / settings-flow plumbing.

Sub-hour, so kept as an inbox note rather than a milestone: ~config + one dashboard card + one e2e assertion. **Execute alongside m11 (MFA)** — both are Kratos account-security features touching the same Settings→Security surface and settings-flow rendering, and both want to land before real tenants arrive (w1/m9) so there's no forced-migration later.

No REST/GraphQL/MCP surface (Kratos-owned, like login/MFA) — dashboard-only, so no Render-parity task needed beyond the account-settings UI.

**Promote to a milestone only if** scope grows past ~1h: per-session detail (device / IP / approximate geo from Kratos session metadata), auto-revoke-other-sessions on password change, or admin-initiated revoke of a member's sessions (would then couple to w4/m12).

Source: `/pm-brainstorm for w4` 2026-07-09 (proposed as the disciplined sub-hour half; the milestone half became m13).
