if not used for read-only a custom token should be used to allow audit logs to record activity to aid in catching abused write access