We care it the token has a permission directly assigned. We use that for limited scope access keys. But with in that limited scope. It needs to something the parent user is able to do