Goal: least-privilege keys per function.
Step 1. Create a sending key with only mail.send scope for the app that sends mail.
Step 2. Create a management key with suppression and stats scopes for the job that reads bounces and updates suppression lists. It never sends.
Step 3. Store them in separate secrets. The sending service never sees the management key and vice versa.
Step 4. Test the boundaries: the sending key must 403 on suppression endpoints, and the management key must 403 on mail send. A 403 here is the test passing.
Step 5. Delete the old full-access key.
Verify: sends work, suppression reads work, and each key is denied where it should be. Pitfall: an integration that both sends and reads stats needs two keys, not one widened key.