How should the limitation of a druid's Wildshape ability be governed?

• Make a saving throw each time they wildshape beyond their daily limit

• They can make one extra Wildshape, but then they're stuck