Chapter 14. Using bound service account tokens