Fix exception granting: don't grant *all* permissions
Initial data model and UI for expiration mode