3scale operator creates token without policy registry scope

During automation for THREESCALE-7932 I've found that 3scale Operator creates only RO access token with scope only for accounts:

{
   "access_token": {
    "id": 319,
    "name": "OIDC Synchronization Token",
    "scopes": [
     "account_management"  <-----------
    ],
    "permission": "ro" <---------------
   }
  },

Users cannot use it(tenantSecretRef) for obvious reasons in any Capabilities CRD for creating objects in 3scale.
There is workaround to access UI or API by admin password(passwordCredentialsRef) to create RW token with wider scope.