At any time you can remove all but the last policy ID/asset fingerprint combination from an existing token role using the /configure-tokenroles policies remove command. Simply provide the parameters matching the existing combination you want to remove and tokens from the respective policy will not be considered for the role any more.
The token role ID from which you would like to remove a policy. You can find this ID via /configure-tokenroles list.
Policy ID of the policy you want to remove from the token role.
If you want to remove a policy/fingerprint combination, you also have to specify the asset fingerprint.