That's what it sounds like in the NIP but I don't know of any other examples out there besides whitelisting users. What would even be the purpose of an ephemeral authorization event otherwise?