Taking users in consideration when placing tokens on permissions