Support limited scoped permission via project keys