It's not a nightmare, in fact different sessions of the same user could be used to grant different capability levels across sessions depending on the trust level.