Skip to main content
Version: v5.7.0

Service account

Included from Basic tier

A service account is a durable non-human identity: a user row of the service_account kind (auth_provider "service_account") that exists purely as a run-as target for standing automations. It has no credential and no login lane — it can never authenticate — and it is policy-assigned like any identity, group membership included. Its username must not be held by any other identity: run-as resolves by username, so a collision would make firing-time authority ambiguous, and creation refuses the clash by name.

Service accounts ride the user resource — there is no separate row shape; see opschain docs resources/user for the fields (the kind field carries service_account). Served by the v2 UserService: CreateServiceAccount creates one, and ReassignAutomations repoints every standing automation a departing user's identity executes — triggers they created with no explicit run_as or are named run_as on, and scheduled activities likewise — onto an enabled service account (authorship stays historical; only the executing identity moves, idempotently). Both verbs are admin-plane gated.

Where service accounts appear​

  • Triggers and scheduled activities name a service account as run_as, making team automations durable across personnel changes; setting one requires the acting author's explicit act-as trust grant covering the automation's path.
  • Agents receive a service-account principal at first registration on identity-backed compositions — the agent's durable identity, carried across re-registrations by (project, code).
  • Trust grants name a service-account principal id as the subject (subject_kind "service_account").

Disabling a user warns what it strands: the owned-automations summary lists the triggers, scheduled activities and agents the user's identity executes or owns, so the operator can reassign them first.

  • opschain docs resources/user — the row shape service accounts share, lifecycle verbs included.
  • opschain docs identity — the component page: identity kinds, providers and the admin plane.
  • opschain docs resources/trigger — the run_as field and its firing-time resolution.
  • opschain docs resources/trust — grants hung on a service-account subject.