Good point depending on your workflow for giving it permissions within the sandbox. Does it need those permissions though? Can't it just ask you to do the provisioning via curl etc? Or do you have it automating your cloud infrastructure, jira, testing servers, and git etc so that you can't disconnect it any more?