ability: local admins cannot change the tokens, only the internal tokens.