3 ms·

If the UA token has all the necessary permissions embedded in it, then it cannot be used to call any service for which the user is not authorized.