Before this release, any member of an org could mint a scoring key, see every key’s prefix and caps, revoke one, open checkout, and change the payment method in the customer portal. The role check existed on one verb, renaming a key, and nowhere else.
Every one of those actions now requires the human owner or admin role. The API
refuses with 403 and the code admin_required. Agent credentials are refused
on the key verbs too, whatever the role of the person who granted them: a
credential is a control surface, and a key that can mint keys would outlive its
own revocation.
Members see one line in the console where the key list used to be: API keys are managed by your org’s admins. A member who needs to score over the API gets a key from an admin, and scoring with that key is unchanged.