new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Temporal · all subjects

authentication/service-accounts

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Service account permissions and roles

Service accounts support account-level roles and namespace-level permissions. Account roles: owner, admin, developer, finance-admin, read, metrics-read. Namespace permissions: admin, write, read. Namespace access is specified in the format 'namespace=permission'. Service accounts can be scoped to an entire account (account-scoped) or to a single namespace (namespace-scoped).

Service Account allocation best practice

Create one Service Account per service or worker deployment, not one shared Service Account for an entire team. This approach gives cleaner ownership, easier rotation, and better auditability than sharing a single machine identity across multiple services.

Account-level vs namespace-scoped Service Accounts

Use account-level Service Accounts only when a service genuinely needs cross-Namespace or account-wide access. Prefer Namespace-scoped Service Accounts when a service should only access one Namespace.

Service Account namespace access principle

Grant Service Accounts namespace-level access only to the specific Namespaces they need.

Give your agent this brain