nice to have: bounding of Guest Access Tokens by Nomadic Identity
Guest Access Token is bound to hub item. I mean, that isn't correct. Because the Guest Access Token is in essence proof of trust towards third parties and therefore is it bound to channel, to Nomadic Identity.
I suggest implement cloning of guest tokens. S. also discussion Bounding of Guest Access Tokens by Nomadic Identity .