Signed in by password.Permissioned by key.

Your password unlocks the console. What you can read and write on each ledger is still decided by the API credential it holds, and the core checks that on every call.