so, at a high level you could use an intersection to do this:

definition token {}

definition user {
  relation token: token
}

definition resource {
  relation viewer: user | token
  permission view = viewer->token & viewer
}

check

resource:foo view token:whatever