Chapter 11. Using bound service account tokens