resource:someresource#somerelation@user:someuser[some_caveat_name:{"expiration": "timestamp goes here"}