you'd store the expiration on the relationship and give the current time when making the CheckPermission request