What Security Rules Do You Apply When Managing Subaccount API Keys on Centralized Exchanges?

Using subaccount API keys on platforms like Bybit enables trade isolation, but maintaining robust account security is essential. Do you restrict subaccount API key permissions strictly to order execution while disabling withdrawal rights and whitelisting static server IPs?