What permissions are required in the access token?