are the token permissions dynamic or are they set and changed rarely?