It doesn't matter if they are added independently or not, I just need to find a solution to ask the database not to grant access to a token if an associated user had no access. An intersection might work.