design "grant permissions"
Now
USER
----
abcde
defgh
Future?
USER PASTE
---- -----
abcde -> abcde
hueytjnsdertertwerwe -> defgh
that is: grants become first-class permission entries, and can be managed separately from paste access.
This will allow for expiring grants maybe.