Service accounts must still be bound to a role, but this ensures apps do not get access to the default service account.