Josh Jewett
For a real-world example, would you provide the resource (whether this is a user or API) assuming the role their own dedicated Key-Pair? If so, does the account admin creating the role have access to those credentials and can take them away at any time?