A user should be able to create an api key with fine grained permissions, up to their roles permissions(if enabled) vs an owner only being able to create owner api keys.