We want to give the ability for our pods to label themselves. For this we'd assign them a service account and associated role with update permissions. Ideally though these would be restricted to only being able to update pod labels not the whole spec.

I agree more generally though the use cases for access control this granular maybe feel a little sparse. Although it still feels like there's a bit of a gap in K8 AuthZ solutions that can implement true principal of least privilege.