Currently in tool_mfa with the 'Trust this device' factor, you can set a period of time a device is trusted for.

A common request is to be able to set a different time here for site admins (e.g. lower time, so their devices aren't trusted as long) or disable it entirely (don't allow site admins to trust device).

In simple setups this could be achieved by combining with factor_role, but more complex setups this would need to be in the factor_token config itself.

This might be able to be extended more generally to "for x role, trust device for y time" but that might be overcomplicating it.