A customer-facing API for the release loop: cut a release, poll it, read its logs, roll it back, and promote between environments. Authenticated with an API key rather than a browser session, so CI can drive it.
The reference is generated from the spec the service serves, so it cannot describe endpoints that do not exist.
Written up properly: grants are per tool rather than per server, a key inherits its creator's authority and can never exceed it, and an unresolvable permission check refuses rather than allows.