Not really? Think of session management: there are many tokens sessions for one user. You use your credentials once to get a new credential with the same authority as the password, but if it stolen it can be revoked without compromising your password. All operations behave as if the session token is the same as the root identity, and the only work that happens when a session is disavowed is that messages signed by the session should be deleted.