Scoped permissions for people and machines — with the dangerous capabilities split out.
Sending email is separate from reading email logs, because your From address is a trusted identity. Invoking endpoints is separate from managing them, so a key can call your APIs without being able to read or rewrite their logic. Permissions map to what things can go wrong, not just to nouns.