The token can be the title player account assuming that title player owns the character. Master player account, title player account, and character entity types have permissions to read and write all the data across them because we consider them as the same "person". You can restrict that by editing the global title policy if you would like.
Also, If you are getting a token by login or exchange, you are getting a title player account
2 People are following this question.
