You know you don’t have to give it permission to a whole zone right?

My DNS provider has per-record permissions, but you could delegate a subdomain even if your DNS provider lacks per-record permissions.