> Also a way to ensure that it's one time only and not a continuous monitoring type situation.

Not quite what you're asking for but access does need to be regranted every 3 months.