Which of the following cannot define the maximum time-to-live (TTL) for a token?

Authentication methods (e.g., LDAP, AppRole) often have specific role configurations that define the maximum TTL for tokens issued through them.

The client system can request a desired token TTL when creating or renewing a token, but it cannot ultimately define or override the maximum TTLs enforced by the Vault server. The maximum lifespan of a token is always capped by the system max TTL, the parent token's remaining TTL, and the specific mount endpoint or authentication method's role configuration, ensuring server-side control over token validity.

Each secrets engine or authentication method mount point can have its own configured `max_lease_ttl` which restricts the maximum duration of secrets or tokens issued from that mount.

A child token's maximum TTL cannot exceed its parent token's remaining TTL or its maximum allowed TTL, whichever is shorter, effectively limiting the child's lifespan.

The system max TTL is a global Vault configuration that sets an absolute upper bound on the lifespan of any token or secret lease in the entire Vault cluster.