I thought about it. And in most cases its probably best if the signer just defaults to permitting everything, and perhaps notifies the user or pulls some handbrake if it detects weird behavior. Aintnobodygottimeformanualallowing.

You can always end the session anyway