Hi @codesmaker
this is hard to tell. This is a conceptual aspect, that is hard to cover in this place.
You might work with validity periods of spass tokens.
You might delete the passthru policy after some time.
You might work with event handlers and script handlers.
This is deep into rollout scenarios where are a lot of different ways to handle this and which very much depends on your needs, your workflows, your user structure, your user expectations, your helpdesk…