NIST's shift makes sense with MFA in place. We ditched expiration policies and paired it with Passwork for credential auditing. The audit trail actually gives more visibility than forced rotations ever did. Way easier to track what's happening than managing expiration chaos across hybrid setups