We need documentation for site admins, because they are starting discussion in the storage support channels with questions how to "configure tokens". This is still work in progress, but CMS is converging to the recommended configuration and once it is ready it'll be advertised via wlcg-doma-bdt mailing list.