By default your Keychain is unlocked when you log into your computer. To control access for each key you must open your Keychain then double click on a key then select the access control tab, then make sure the confirm before allowing access is selected and check the ask for keychain password is checked.
Yes, thank you. I have done that on most of them and it works well. My frustration is that the autofill in Safari seems to be the only way to engage Keychain. When I don't select autofill in Safari, I can't engage Keychain at all (without manually opening it and viewing an individual key). I'd like to be able to activate Keychain selectively as I did in Leopard.
For those sites where I have multiple accounts, I have discovered that if I deny the first pop-up from Keychain, I can then delete the autofilled login and enter the first character of the one I want, and the pop-up appears again. It's just frustrating to have to take those extra steps.