It's even worse: "Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access". This goes against all principles of good security design. A token that gives root access instead of specifying a particular action allowed just invites misuse, erroneous or malicious.

I would expect these tokens to be like JWT or macaroons, carrying specific permissions within specific bounds / tenants. Alas.