Should "ID" in Record Access be required?

[dvanmali]

Record Access requires the token field "ID" to be defined. I'm adding this discussion to recommend making this field optional:

• Permissions could be based on other methods that are not necessarily user-bound or record-bound, concepts such as roles or anonymous authenticated use.
• Access using external providers likely uses the "sub" field, without an ability to enable custom fields on the token.
• "ac" already exists as a field to signify the auth level is 'access' and not system level. This should provide the ability to distinguish between token types for verifying.