Inactive sessions are formally required to terminate after a defined period
Setting a maximum idle time before sessions lock is a concrete access control rule for who can act on an already-authenticated session, not only who can start one.
Session idle timeouts protect an already-authenticated session rather than the credential itself, a related safeguard that sits next to A.5.17's authentication information controls.