Labels do not expire. They remain valid until the ALA reports a new label value for the client's owning user by means of a Broker::ALA::change document.

The Broker does attempt to refresh the client's access label each time the client reconnects. For shared-state clients, this happens each time the number of connected clients goes from zero to one.

If an ALA wants to expire labels, it may do so by issuing Broker::ALA::change documents, using its own expiration policy. Note that change documents apply to all clients with a matching DN and issuer DN pair.