xibility to identify a machine, a user, a workload, or a group of workloads (different workloads can run as the same service account).</p></li><li><p>The service account a workload runs as won’t change during the lifetime of the workload.</p></li><li>Service account uniqueness can be ensured with domain name constraint</li></ul><h3 id="communication-security">Communication security</h3><p>Service-to-service communication is tunneled through the client side <a href="https://envoyproxy.github.io/envoy/">Env