user([user:write]) -> token([user:write, user:delete])

check(token, 'user:delete') = false
check(token, 'user:write') = true

both subjects have to have a relation to the same permission to eval to true sorry for the rough pseudocode