Really interesting release. The combination of service accounts, workload identity, token exchange and actor chains addresses a lot of the auth problems that show up once agents start calling other services and acting on behalf of users. The reduced-scope delegation is especially nice.