I'm thinking that we shouldn't leave around forever 'unactivated' permissions. Since you have a granted time stamp, you could easily throw an exception if the activation attempts is after some expiration period.