Added top-level token permission and move write permission to job level for security reason

[zibaiwan]

Testing is done from my personal fork with temporarily modified the registry.