Do we have set up a new caveat for every token or every relation from the user to the token?