><h3 id=strong-identity>Strong identity</h3><p>Istio Auth uses <a href=https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/>Kubernetes service accounts</a> to identify who the service runs as. The identity is used to establish trust and define service level access policies. The identity is assigned at service deployment time and encoded in the SAN (Subject Alternative Name) field of an X.509 certificate. Using a service account as the identity has the following advantages:</p>