Question about SSH Access Key scope

[Stacy O_Dell]

When adding an Access Key (SSH public key) at either the workspace, project, or repo level, is the scope of access truly limited to be read only?

The UI for adding keys seems to indicate that is the case for the project and repo level access keys, but the UI for adding workspace level access keys is not explicit about that.  I also couldn't find anything in the documentation per se.

My goal as we transition to BB Cloud from Data Center is to potentially eliminate the need for any service accounts that may have been previously used by automation simply for cloning and accessing repositories for read only purposes.