Tasks are a good scope for zero trust permissions