Given that we have to create tokens manually through the admin anyway, I think it's fine to have to add the user to a group with limited permissions at that point as well.