can I, and how would I do it, create tokens to be used in an external service, without giving it full access? Like, e.g., I want a service to have read access to a certain table. As far as I understand, root tokens give full access... Is there a way to limit this? Or how can I generate tokens with limited access to be used in another service?