It seems the most universal and safe way to deal with it would be to have some utility to drop the PAG, if that is at all possible. Why not acquire a new pag with no tokens when you start a service? That's what I do.