Final answer:
After a policy change, may_dirty sessions are flagged as Invalid to prevent inconsistencies and ensure compliance with the new policy.
Step-by-step explanation:
When a policy is changed, all may_dirty sessions are flagged as Invalid. This flag indicates that the session state may not conform to the recently updated policy, which could lead to inconsistencies or potential security risks if the session were to continue as valid. By marking it as invalid, the system ensures that the session cannot be used until it undergoes a validation process or the user re-authenticates, thereby aligning with the new policy requirements.