Authorization error during restricted Role-bound API key access

FaunaDB implements least-privilege access through Role documents that define specific permissions for collections and indexes. While short-lived session tokens issued via Identity support configurable TTLs, standard server, database, and collection-scoped API keys are persistent by default.

The current security model lacks a native mechanism to enforce automatic expiration or mandatory rotation policies for these long-lived API keys. If a key is bound to a Role with insufficient privileges for a specific query, the engine returns an authorization error, but the key itself remains valid until manually revoked or deleted by an operator.

Is there a method to set a maximum TTL for static API keys directly within the Fauna control plane? How does the system handle the graceful transition of credentials during a rotation to prevent request downtime without external orchestration logic?