Service Account
An identity type in Google Cloud used for machine-to-machine authentication. It signs requests with a key pair and is suitable for automated workflows calling protected APIs.
Timeline (last 90 days)
Assigning agents a static service account directly is still insufficient, because service accounts tend to be long-lived and broadly permissioned, and multiple agents may share the same account, making it impossible to distinguish in logs which agent instance acted.
Service accounts are machine accounts for non-human identities, typically granted long-lived keys for service-to-service calls, and they are often over-privileged, difficult to rotate, and not bound to a specific person; once obtained by an Agent, they become a ghost identity with no MFA, no behavioral baseline, and the ability to lurk long-term.
When calling Vertex AI in n8n, authentication follows the Service Account route: in n8n's predefined credentials → Google Cloud API, fill in the region, the service account email, and the scope URL.
A Service Account is an identity type in Google Cloud used for machine-to-machine authentication; it has no password and proves its identity through a pair of keys (a unique email address and a private key); when calling the Vertex AI API, a personal account usually cannot be used for interactive authorization, so a service account is the standard solution.
Traditional machine identities typically exist in the form of service accounts or API keys, with relatively fixed permissions and lifecycles managed manually.
Traceability of the delegation chain is a capability that the traditional Service Account model lacks.
When training jobs are submitted on behalf of users by a platform service account, the service identity rather than the real user is recorded in the logs, resulting in an audit gap.
Guiding clients to create separate restricted service accounts for automation projects is one of the best practices for reducing the risk of credential leakage.
One best practice is to guide clients to create a dedicated service account for automation projects, granting only the minimum permissions necessary to complete the task, rather than sharing primary account credentials.
Guiding clients to create dedicated service accounts for automation projects and grant minimal permissions can limit the attack surface in the event of a credential leak.
All Facts (10)
Assigning agents a static service account directly is still insufficient, because service accounts tend to be long-lived and broadly permissioned, and multiple agents may share the same account, making it impossible to distinguish in logs which agent instance acted.
50%UnverifiedService accounts are machine accounts for non-human identities, typically granted long-lived keys for service-to-service calls, and they are often over-privileged, difficult to rotate, and not bound to a specific person; once obtained by an Agent, they become a ghost identity with no MFA, no behavioral baseline, and the ability to lurk long-term.
50%UnverifiedWhen calling Vertex AI in n8n, authentication follows the Service Account route: in n8n's predefined credentials → Google Cloud API, fill in the region, the service account email, and the scope URL.
50%UnverifiedA Service Account is an identity type in Google Cloud used for machine-to-machine authentication; it has no password and proves its identity through a pair of keys (a unique email address and a private key); when calling the Vertex AI API, a personal account usually cannot be used for interactive authorization, so a service account is the standard solution.
50%UnverifiedTraditional machine identities typically exist in the form of service accounts or API keys, with relatively fixed permissions and lifecycles managed manually.
50%UnverifiedTraceability of the delegation chain is a capability that the traditional Service Account model lacks.
50%UnverifiedWhen training jobs are submitted on behalf of users by a platform service account, the service identity rather than the real user is recorded in the logs, resulting in an audit gap.
50%UnverifiedGuiding clients to create separate restricted service accounts for automation projects is one of the best practices for reducing the risk of credential leakage.
50%UnverifiedOne best practice is to guide clients to create a dedicated service account for automation projects, granting only the minimum permissions necessary to complete the task, rather than sharing primary account credentials.
50%UnverifiedGuiding clients to create dedicated service accounts for automation projects and grant minimal permissions can limit the attack surface in the event of a credential leak.
50%