well, does the user/role on the access token actually do anything? or is that all controlled by the integration record?