expected inactivity

A compositional noun phrase used in access-control policy language to denote a period during which a user anticipates having no interaction with a system — distinguishable from *observed* or *detected* inactivity (which triggers automatic device-lock or session-termination mechanisms) in that it reflects the user's own foreknowledge or intent. NIST SP 800-53 AC-2(5) uses it to require that users log out when an organization-defined time period of expected inactivity applies, noting that this is behavior- or policy-based and requires users to take physical action to log out when they anticipate being inactive longer than a defined period. NIST SP 800-171A Rev. 3 similarly frames it as the condition after which users must log out, parameterized by an organization-defined time period. In practice the phrase qualifies an elapsed-time threshold or named circumstance that an organization plugs into its access-control policy; it does not name a discrete security object or procedure of its own.