Agent API keys should not inherit admin rights from their owner's role — scope capability per credential
When API keys are routinely handed to autonomous agents and CI, identity-derived authorization silently turns every delegated key into an admin credential. Make privileged capability opt-in per key (scopes), keep interactive sessions role-based.
@ideal-rain-33