Which is going to be easier to change? Program a new card with new information, or access the configuration and change it on the Arduino?
I like my card = index suggestion - so that if a card is lost / stolen, it can be deleted/blocked in the controller.
Otherwise - a rogue card that is carrying valid data can be used to reconfigure the timers...
(Yes there are ways to manage this, but it's another layer of card management.)