Thanks for the detailed use case! Scoped or limited-permission API tokens are not something I can confirm as a current feature in Decile Hub, and I don't have visibility into the roadmap for this specific capability.

I'll flag this for the team as a feature request. It's a really practical need, especially for automated agents where full read/write access is more than necessary. We'll look into it!