Ok, I incorrectly made the assumption that when accessing a resource you want to use the zedtoken on the resource in question. When using inherited relationships/permissions I should use the zedtoken on the "higher level" resource