Returns the LIVE authorisation, or 204 No Content when there is none or
the window has lapsed. Liveness is computed against the clock at read time — there is
no status column, so a lapsed authorisation can never read as a live one because a
sweeper has not run yet.

sessionActive answers the question the authorisation itself cannot:

whether a support operator is inside the window RIGHT NOW, as opposed to merely
being permitted to be. The two are different facts to a tenant administrator and
only the second warrants an interruption.

The body carries no session identifier, no session JTI (it is a live revocation key) and no impersonator identity. The actions taken during a session are accounted for in the tenant's audit trail, which is derived from signed events.

reason is ABSENT when the reader is impersonating.

The text is the tenant's own, written for the tenant's own record. An impersonation
token authorises as the tenant administrator and therefore carries
admin.tenant.support-access.read, so without this the operator would

read the tenant's private justification for admitting them. The decision is
fail-closed: a claim that cannot be read withholds. Every stored grant has a reason
(it is mandatory at declaration), so an absent field means it was not disclosed and
never that there is none.