Modify the default_athentik_login to have two user_login

Here is my objective: I am trying to ensure that when authenticating on authentik the users who are in my users group can connect and have an 8 hour session by default or a 3 day session if they choose stay signed in. Users in the admin group will not be able to choose stay signed in and they will have an 8 hour session.

So I think we need to modify the "default_authentication_login" flow.
I don't know if I should do a new stage or a policy. Or both ?

Here is what I have in my flow at the moment :