[tpm2] Can an unauthorized key be verified with activatecredential.

I've been using a copy of tpm2_tools 4.0.x (and 5.x something) and I created a key just for parameter encryption that specifically has decrypt but adminwithpolicy and no userwithauth with the blank policy.  The idea was that there was no way the key could be used to decrypt a session later as there's no valid way to authorize it.  This seems to work just fine in Tools and the ESAPI so I figured nothing was wrong with it.

I'm now trying to add verification via endorsement key to the process.  I can run an activatecredential on essentially any key except this session key.  Does the activatecredential command require authorization for all objects and that's why it's failing?

If so what's the recommended replacement?  Can I just make a restricted encryption key and use that for establishing and encrypting/decrypting session?