We need the ability to prevent the creation and use of PATs. Currently our users are creating custom AI tools that are using PAT to connect to admin APIs. This causes both a security concern for us, as well as production impacts by eating into the shared TPS constraints to these APIs.

We would like either the ability to apply a policy to the creation feature, or an account toggle to completely turn it off. This is not functionality we want exposed to 3k+ users that have little domain knowledge with no ability to apply checks or restrictions.