Use a session-based permission set to allow functional access only during a predefined session type. Flows or SOAP API can be used to activate and deactivate the session-based permission set. Flow Components to Activate and Deactivate the permission Set