We've shipped a change to service token permissions. Now, any service token with create_databases, will automatically be granted full permissions to any database that it creates.
With this change, you can fully automate creation + management without needing to grant more permissions to your service token.