The "With their API keys" section of a member's record (section 3.2) narrows what **any key that member creates from now on** can end up doing — it's the **ceiling** for their future keys. The "What this key can do" picker that person sees when creating a specific key (Manual 50, section 7) can only narrow **within** that ceiling, never exceed it. Keys that member had already created **before** this narrowing don't change — a key's permissions are sealed the moment it's created (Manual 50, section 2).