Elasticsearch API key role_descriptors bounded by creator privileges

Scoping API keys below creator privileges

We need to issue Elasticsearch API keys for an external integration that must not reuse the built-in elastic user or inherit full cluster access. The documented behavior is that a key created via POST /_security/api_key inherits all privileges of the creating user unless role_descriptors are supplied. Those descriptors are capped by the creator's permissions.

This creates an unresolved design decision: if the creator is an administrator with broad access, the resulting key cannot be scoped more narrowly than that administrator's role, even if the integration only needs read access to one index. We are evaluating whether the only supported pattern is a dedicated low-privileged user for key issuance, or if another documented mechanism exists to decouple the key's effective permissions from the creator's privileges.

Behavior may vary by version because security defaults and TLS setup changed in Elasticsearch 8.x, so local test clusters may not reflect production constraints. It is unconfirmed whether version-specific changes affect role_descriptors validation against creator privileges.

Is there a supported way to create an API key whose permissions are narrower than the creating user's privileges without introducing a creator account? If role_descriptors are always bounded by the creator, what is the recommended least-privilege pattern for external integrations in 8.x? Does the API expose a validation error that reveals the privilege boundary when a descriptor is rejected?