caveat is_not_expired(current_time timestamp, expiration timestamp) {
    current_time < expiration
  }

  definition document {
    relation viewer: user with is_not_expired
    permission view = viewer
  }