Option A needs a time attached, because revoking sessions doesn't stop an access token that was already issued. In Entra ID, for example, Microsoft's revoke-access guidance says that for apps using access tokens the user loses access when the token expires, and the default access token lifetime is a random 60 to 90 minutes. Apps that support Continuous Access Evaluation can cut access off in near real time. The rest can't.

For the exercise, I'd add a column to the decision log: the earliest time the containment actually holds. If sessions are revoked at 09:25, that's up to 10:55 for an app without CAE, and someone has to watch the export logs through that window. It also gives the drill a concrete question: which of our apps honour CAE, and which keep working for another hour and a half?