I mean, let me limit a token's access to only a certain repository or subset of images or whatever the service is, rather than anything in my account.

Separate accounts are a massive pain to manage by comparison.