Balances access token lifetime against refresh churn and risk.
Lifetime is required
breach window is required
Formula
exposureWindow = min(lifetime, breachWindow)