[mfontani]

Indeed, "but" the minimum token you can create is one that allows its wielder to edit a whole zone's DNS, not just (say) one specific record.