Restrict API Tokens

I am setting up a staging environment. I want to create an API token that can only modify certain workers for specific domains. but it appears that workers are under the Account (Global, not bound to a specific zone) and as such I cannot restrict an API token to have access only to certain workers. So what's your recommendation to create an isolated API token? Create a second account?