I think i'll probably stay with the one token for the entire service, until spicedb starts to slow. If it does, then i'll implement the recursive query shenanigans