For our hard tokens, we created a custom class off of the Configuration items root. Basically, the class form only shows the Serial Number, Model, Location and Owner/Managed By Group, and Assigned to. This was more about our asset management process, so we only needed to address hard tokens. And we locked it down so only the Managed By Group can edit or assign the CI. The Owned By is a select group of approvers and used in our workflows. But we are only at crawl stage so no Services assigned beyond that. We didn't want to get ahead of ourselves.
