you can't give a PAT only read only access to a specific repo, correct? (I may be wrong about this)