You can always remove Z later, but for the initial authentication I think you do have to grant all the permissions it asks for.