Service Accounts

A Service Account is a named, non-human principal for automating Axec tenant management. It belongs to exactly one tenant and has an explicit, normalized management-permission ceiling.

Service Accounts are separate from Applications:

Principal	Purpose	Authority source
Application	Calls or exposes governed runtime capabilities	Application Credential plus delegated Grants or eligible gateway attachments
Service Account	Automates tenant management APIs	Service Account credential exchanged for a short-lived management token

A Service Account does not inherit a Workspace User role, group membership, Application authority, User Connection, or Grant authority.

Authentication flow

Service Account credential
  -> tenant OAuth token endpoint with client_secret_basic
  -> short-lived token for the management API audience
  -> tenant management request

The requested permissions must fit entirely within the Service Account’s current ceiling. Axec rejects attempts to widen them rather than silently issuing a narrower token. The long-lived secret is accepted only at the token endpoint, never directly by a management resource.

Credential lifecycle

Each credential generation has its own identity, safe fingerprint, lifecycle, and optional expiry. Its plaintext secret is returned once; inventories expose only safe metadata. Multiple active generations can overlap briefly so clients can rotate without losing attribution.

Every management request reloads the tenant, Service Account, exact credential, token audience, and current permissions. Disabling the principal, revoking its issuing credential, or narrowing its permissions therefore restricts subsequent requests immediately.

Administration and evidence

Trusted operator provisioning bootstraps the first Service Account. A tenant administrator—or a Service Account with the exact administration permission—can then manage Service Accounts within that same tenant.

Evidence attributes token issuance and management mutations to the exact principal and credential without storing plaintext secrets, hashes, complete tokens, or authorization headers.

Follow the Service Account guide for a rotation-oriented automation workflow.