CloudKit: how to prevent 2 devices read/write the same private database

I'm using CloudKit private database to sync the progress of my game among the different devices of a determinate user.
So far so good, works nicely.

But I don't know how to avoid this user to play the game with 2 different devices at the same time.

Ideally I would like to kick the first device out of the game when the second one enters, but not allowing the second device would also be an option.

I thought about using subscriptions but the more I read about them the more they seem oriented for push notifications so I was wondering if there's an easier way.

Also thought about creating a 'keepAlive' register which I could set the timestamp every minute or something like that to tell the second device the game is in use... but I also find it a bit messy and unnecessary...

I guess there has to be an easy way to do this that I'm missing.

Any hint?