We are preparing a small, time- and cost-bounded isolated test on an existing Hobby plan. Before creating a Project Token or test resources, we need to confirm the supported least-privilege route. The CLI docs describe Project Tokens as environment-scoped/deployment-related; the official CLI v5.58.0 schema exposes this query shape:

query UsageScope($projectId: String!, $from: DateTime!, $to: DateTime!) {
  usage(projectId: $projectId, startDate: $from, endDate: $to,
    includeDeleted: true,
    measurements: [MEMORY_USAGE_GB, CPU_USAGE, NETWORK_TX_GB, DISK_USAGE_GB, BACKUP_USAGE_GB],
    groupBy: [ENVIRONMENT_ID, SERVICE_ID, VOLUME_ID]) {
    measurement
    value
    tags { projectId environmentId serviceId volumeId }
  }
}

All variables are placeholders; no token/API call has been used to test this.

1. May a Project Token bound to one environment execute usage in this form? If supported, please provide the supported request shape and clarify whether the server returns only its bound environment, all project environments, or workspace data. Is environment isolation enforced by authorization or only by client filtering? Does estimatedUsage(projectId: ..., measurements: ...) support this token, and what scope does that result cover?
2. Are these raw usage measurements or monetary billing amounts? What are the exact units for each measurement/value, update frequency and maximum reporting delay? Which charges are excluded (for example retained/deleting Volumes, backups, egress, platform fees/taxes or other billable usage)? How should deleted resources remain attributable until their final charge is visible?
3. If this Project Token cannot read the required usage, is there an officially supported narrower read-only usage route that does not require account/workspace management credentials?
4. The API examples list deploymentStop(id) for running deployments and deploymentCancel(id) for building/queued deployments. Can the same environment-bound Project Token execute both, with server-enforced rejection outside its environment? What is the supported handling for DEPLOYING, and do any additional environment-scoped actions/settings prevent pending or automatic redeployment after a stop?
5. Volume documentation says deletion is queued and permanent deletion occurs within 48 hours. At what exact event does storage billing stop: accepted deletion request, unmount, physical deletion, or another event? Is the recoverable 48-hour window billed, and what supported status/receipt confirms the billing cutoff?

We are requesting technical information only. Public documentation/examples or a precise permission statement would let us prepare the controller without creating a broader credential.

References:

https://docs.railway.com/cli/deploying

https://raw.githubusercontent.com/railwayapp/cli/v5.58.0/src/gql/schema.json

https://docs.railway.com/integrations/api/manage-deployments

https://docs.railway.com/volumes/reference