I've tried to find explicit documentation for the role to select when creating an API key for use with
xcrun altool --notarize-app --apiKey
But only found a discussion like Using an API Key with iTMSTransporter. Should it always be App Manager, or is there a less-priviledged one for this task? Notarization doesn't seem like it would require significant access.