ec045ed216
The docs currently indicate that setting permissions on service account tokens is a future feature, but it can be done today with the ABAC authorization plugin.