i can just see this being a mess when someone loses their token and then has to redo any roles/users and im not sure storing it on an user record is "correct". There doesn't seem to be netsuite provided answer for it other than "write it down"