We are working on a feature for our commercial offerings that offers downscoping of access tokens to limit writing relationships and checking permissions to a subset, per caller.