Give each Personal Access Token only the organizations, projects, and permissions it needs.