Do you enforce inactivity timeouts to lock applications/access after a set period of time?

Tokens are being invalidated after 30 minutes of inactivity after that time, the user must login again. We don’t delete the user.