So my understanding of zedtokens is they're used to prevent accidental access to a revoked resource when spicedb is eventually consistent with the application.