ws-securitypolicy clarification

Can someone with more practical experience with ws-securitypolicy please help clarify something for me? If I want to include a token assertion inside of a SupportingTokens assertion and attach that to a message in WSDL (not the endpoint), how should the IncludeToken attribute be used? Do I just eliminate all recipient -> initiator options so the resulting values that only make sense are now Never, Once, and AlwaysToRecipient? The default value listed in the spec is Always which includes recipient -> initiator which I guess in this case would really act the same as AlwaysToRecipient. And, I would also assume that initiator and recipient are relative to that message only, so the initiator and recipient roles would be reversed when attaching policies to the output message.

ws-sx message