Unverified50% confidenceFactExact time
Service accounts are commonly used for server-side calls, and short-lived tokens can be obtained via a key file or the more secure Workload Identity approach.
1
Sources
50%
Confidence
Long-term
Relevance
10/23/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedService accounts are machine accounts for non-human identities, typically granted long-lived keys for service-to-service calls, and they are often over-privileged, difficult to rotate, and not bound to a specific person; once obtained by an Agent, they become a ghost identity with no MFA, no behavioral baseline, and the ability to lurk long-term.76% similarUnverifiedFor applications using client secrets, migration to certificates or workload identity federation should be prioritized to reduce static keys that can be stolen.75% similarUnverifiedAPI keys and service tokens are often overlooked when employees change positions, because their ownership is recorded in application configurations or key management systems rather than in HR or directory services.72% similarVerifiedIn the embedded token scenario, the server signs the token with a private key, and the Databricks platform uses the corresponding public key to verify the signature's integrity.72% similarUnverifiedCredentials should be injected by a secrets manager, not written into prompts or source code, using least-privilege service accounts.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1087878API
curl https://kongchang.com/api/v1/knowledge/claims/1087878MCP
get_claim(id=1087878)