I think we could simplify the safety TTLs in a different object, and treat them separately from tenant TTLs.