Yeah but I think it's because it is a hierarchical structure. Active key has all permissions except for owner permissions.

So in my mind the posting key is just a limited scope of active. If it is entirely separate there's nothing to worry about, maybe.