It depends on what you actually want to ask permissions for. We're still doing trivial script execution, but we could go further. Capabilities like "do you allow giving access to JIRA read only token" would be a massive improvement. But there are other paths too.