To register a host, users need the following permissions:
Agent pairing. Read access to the host, either via "Read access to all hosts and folders" or via via contact groups. Write access to the host, either via "Write access to all hosts and folders" or via "Modify existing hosts" and write access to the specific host via contact groups.
So that’s still big, right ?