A control-room terminal left unattended is a real exposure: anybody walking past an open session can record a move as somebody else. Sessions now end after a period of inactivity, and Settings → Session security lets an account owner choose that period, between 5 minutes and 12 hours.
How long is tolerable is a judgement about your premises rather than one we should make for you. A manned VTS desk and a shared tablet on a quay do not want the same number. Where nobody has chosen, the default is 30 minutes and the settings page says as much.
A device still holding work that has not reached the server is never signed out, however long it has been idle. Signing it out would strand that work behind a login the operator may not be able to complete. If a session stays open for that reason, the app tells you why.
Being signed out for inactivity now says so, and returns you to the page you were on.