Added:
6.3 Client connections to global services
A GlobalDiscoveryServer is an OPC UA Server implementing different global services for discovery, Certificate management, user or PubSub key management, user authorization, software and device management.
The number of OPC UA Applications using the different services as OPC UA Client may be huge and the OPC UA Server ist most likely not able to handle connections from all OPC UA Clients at the same time.
Therefore an OPC UA Client connected to a GDS should minimize the time it is connected to the GDS to the currently required actions. The OPC UA Client shall disconnect as soon as they completed the sequence of actions needed to interact with the services. The OPC UA Clients shall not keep connections open between the execution of sequences.
A GDS OPC UA Server is allowed to close Sessions with OPC UA Clients not authenticated as one of the GDS administrative roles if it runs out of connection resources. If the GDS want to close Sessions, it should first close Sessions without special Privileges for the GDS. Otherwise it could close the Session that was inactive for the longest time not using GDS Method calls.
It is also recommended to use a short maximum session timeout on the GDS OPC UA Server.
Actions done cyclicly by OPC UA Applications like cyclically Pull certificate management shall start at random offset in the cycle period.

Agreed to changes edited in Munich F2F.