access right and tokens