In order to authorise that, I need to identify the service, hence a service account (not k8s specific, that's just an authN concern)