What permissions should be granted to the personal access token? It would be good to specify what the minimum access is.