Service account interaction

Service authority is the intersection of token scope and collection rule.

A credential with records:write still fails if the operation's rule does not allow actor.kind == "service". Conversely, a service rule cannot grant a scope absent from the token.

This two-part boundary lets deployments distinguish public application traffic from trusted backend jobs without granting either administrator authority.