The token can have any and all permissions we define assigned to it. That is valid. We just want it's parent user to be a gate indicating the permission is permissable. Both things need to be true, or the result is false. If the token has no permissions directly assigned to it then we default. To what ever the user has