Not sure what cookies have to do with it. If we would use a system where the client software only obtains the secret that the user is asking for, it can later s

Not sure what cookies have to do with it. If we would use a system where the client software only obtains the secret that the user is asking for, it can later say which credentials were accessed and thus need to be rotated when the employee leaves. If session cookies are still usable by an employee whose account was deleted, that's a vulnerability...