How to restrict user access to tokens within VIP