Right now API tokens have Admin permissions, they can perform any operation - CRUD operations on the catalog, as well as triggering self-service actions.
This feature aims to add support for permissions and RBAC support to API tokens. This would enable for example API tokens with read only access, tokens that can only trigger actions but are unable to directly change the catalog and more.