Yes, exactly.
I use this one:
It does support token policies but it’s a CLI tool that won’t hold your hand and assumes some familiarity with the API. Token policies are not the most intuitive feature of deSEC, unfortunately.
Try it out to see if it works for you.
Not sure if there are other clients that support token policies. You could check the ones linked here (I don’t have personal experience with any of them):