diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index f0a689d6c50..705ea01f690 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -2240,8 +2240,13 @@ async def generate_service_account_key_fn(
     )
 
     if data.metadata is None or data.metadata.get("service_account_id") is None:
-        service_account_id: Final = (data.metadata or {}).get("service_account_id") or data.key_alias or str(uuid.uuid4())
-        data.metadata = {**(data.metadata or {}), "service_account_id": service_account_id}  # rebind-ok: stamping the generated service_account_id onto the request model so it persists on the key
+        service_account_id: Final = (
+            (data.metadata or {}).get("service_account_id") or data.key_alias or str(uuid.uuid4())
+        )
+        data.metadata = {  # rebind-ok: stamping the generated service_account_id onto the request model so it persists on the key
+            **(data.metadata or {}),
+            "service_account_id": service_account_id,
+        }
 
     verbose_proxy_logger.debug("entered /key/generate")
 
diff --git a/litellm/proxy/management_helpers/team_member_permission_checks.py b/litellm/proxy/management_helpers/team_member_permission_checks.py
index a7e75caeb69..a076d8240c6 100644
--- a/litellm/proxy/management_helpers/team_member_permission_checks.py
+++ b/litellm/proxy/management_helpers/team_member_permission_checks.py
@@ -85,10 +85,9 @@ class TeamMemberPermissionChecks:
             check_db_only=True,
         )
 
-        # 4. Resolve the caller's role in the key's team (service accounts act as "user")
         caller_team_role: Final = _get_caller_team_role(team_table=team_table, user_api_key_dict=user_api_key_dict)
 
-        # 5. Check if the team member has permissions for the endpoint
+        # 4. Check if the team member has permissions for the endpoint
         has_permission: Final = TeamMemberPermissionChecks.does_team_member_have_permissions_for_endpoint(
             team_member_role=caller_team_role,
             team_table=team_table,
@@ -224,7 +223,6 @@ class TeamMemberPermissionChecks:
             check_db_only=True,
         )
 
-        # 4. Resolve the caller's role in the key's team (service accounts act as "user")
         caller_team_role: Final = _get_caller_team_role(team_table=team_table, user_api_key_dict=user_api_key_dict)
         return caller_team_role is not None