Following on from Onno's Tokens. They can be used as frequent or infrequent users.
Frequent User mode = 1 assigned known user to access apps on a given server as per their security rights any time they want to.
Infrequent User mode = 10 sessions of 1 hour to be used by a group of unknown users. Once the token is used for the hour/disconnected it is deactivated for 28 days until it become active again,
Tokens can be repurposed when active from frequent to infrequent and visa versa and can be assigned to separate streams to ensure they are only used for particular apps on the same server.