So then how do you limit the lifetime of a role associated with a user?