add different abilities per access token