Permissions based on new group/user custom fields

[zmaster7]

With the introduction of #10600, is there a possibility that I am missing to use the $user token under constraints with these new custom fields? My idea would be to simplify the permissions by creating a custom group/user multiple objects field at the tenant level, and using those field(s) to apply read only permissions for anything tied to said tenant by use of $user token constraint. I am aware that giving modify permissions this way at the tenant level could allow the permissions to be circumvented.

For example, one might create a new custom field called "readonly_user" of type (multiple objects) "Object (User)" at the tenant level. Then, a Device "can view" permission can be created with the constraint: { "tenant__custom_field_data__readonly_user__contains": "$user" }.

As it stands, I haven't found a way to get the $user token to work, I'm guessing it's because the $user token is a username and the custom field is based off the id? Would I need to request the creation of a $user_id token, and while we are at it a $group/$group_id token as brought up in #11938?