Password rotation policies are a core security control, regulating how often a password must be changed and under what conditions. When these policies are user config dependent, the configuration is set per account, not globally. This means rotation intervals, grace periods, and enforcement logic can differ across roles, departments, or