Subscription Entitlement Ideas

I have many users saying they cannot access products and we try the Activation Wizard again and it is not clear why products will not activate. I am not sure whether it is connection to the Bentley server, whether my Exception rules are working, whether the users local cache of activation is refreshing perhaps (? ) - Who knows... etc etc. What I need is a sequence of checks to inform what the issue might be. Often waiting 15 minutes, or maybe a day or two and things correct. Not ideal. I am thinking - Connection to Bentley Activation Server = Success. Request for Product XYZ = Deny (Exception Rule set for User) - Something like this.

I spent the time required to Deny access to all products by default, create exceptions to those products we actually own, add license alerting with a strongly worded message to terminate the application. I can't see what is wrong when users say they cannot access products.