I suppose I can deal with it by always having a time-based caveat and 'regular' users have infinite access duration (or whatever the closest to that is using a CEL

duration

)