What Security Rules Do You Apply to Subaccount API Keys on Centralized Exchanges?

Executing trades via API requires balancing automation efficiency with account safety. Do you restrict subaccount API permissions strictly to spot/futures execution while disabling withdrawal rights and whitelisting static server IPs?