design "grant permissions"
USER ---- abcde defgh
USER PASTE ---- ----- abcde -> abcde hueytjnsdertertwerwe -> defgh
that is: grants become first-class permission entries, and can be managed separately from paste access.
This will allow for expiring grants maybe.
To upload designs, you'll need to enable LFS and have admin enable hashed storage. More information