Vote+
This should be implemented on the Role definition. Today there's a check box for "Allow guest pass generation", this should be extended with options for restricting various guest pass parameters.
By doing it on the role definition, we could have different AD groups with different guest pass limitations.
Like "Guest Pass Manager - Unlimited" and "Guest Pass Manager - Max 7 days"