Bastille API development continues with support to delegate granular access keys for users or service accounts.
In other words, you can generate API keys that only have access to certain commands within Bastille or Rocinante.
This foundation should allow for service accounts that are limited to only the 'service' subcommand or to execute zfs snapshots or whatever other limited scope you need.
We want to make this a powerful tool for you without compromising security.