What is a service account?
A service account is an identity belonging to a program rather than a person. It authenticates with a key rather than a password, and carries an explicit, usually narrow, set of permissions.
Using one instead of a human account matters for attribution as much as security. When a nightly job runs under someone’s personal login, the audit trail says a person did it, and revoking that person’s access breaks production.
Good practice is one service account per calling system, with the smallest permission set that works, and keys that expire.
Service accounts are environment-scoped and their API keys are shown exactly once. The permissions requested during token exchange must be a subset of what the account was granted.
Related terms
- Token exchange — Trading a token issued by one system for a scoped token issued by another, so an application can act with narrowed authority.
- Secret reference — An opaque pointer to a credential held in a vault, used in place of the credential itself.
- Connection — The binding between a reviewed action and a specific account on the provider, carrying a reference to a stored credential.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.