correct, you would have to use the zedtoken from the latest permission mutation to capture all of the permissions affected