Well, one of the specific [privilege separation](http://en.wikipedia.org/wiki/Privilege_separation) strategies recommended for OAuth is for different parts of an app to actually have different access tokens, where each token carries the minimum permissions needed for its respective part to do its job. That, coupled with the fact that we don't currently do anything to prevent an issuer from having multiple access tokens active at once, made me think that the union would be the best approach for now.