IAM access keys question

I know that an access key gives programmatic access to your AWS account and that an access key of a root account gives full access, but is the access key for a created user limited by the permissions that the user has? I understand it's best to create a user with only the permissions needed, and then create an access key for that user. Is that why?

This may sound like a basic question but I can't find a confirmation of this. I'm hoping someone can confirm this.