> What's the best practice in managing user data keys so that data is available only when there's an authenticated user around?

What does it mean for an authenticated user to be "around"?

If you want a human to manually approve the decryption operations of the machine, but it can still store/encrypt new records, you can use HPKE so that only the person possessing the corresponding secret key can decipher the data.

At least, you can until a quantum computer is built.