Service accounts with proper privilege isolation should really be the norm here