You’d still have to handle the complete flow for the case where the exemption has been used multiple times since the last authentication though.