generally you do this by having the token "attach" to the user (or vice versa): you don't care if the token is granted a permission, so long as the check includes the underlying user's access