apiVersion: v1
kind: ServiceAccount
metadata:
  name: hermes-execution-worker
  namespace: hermes
  labels:
    app.kubernetes.io/name: hermes-execution-worker
    app.kubernetes.io/part-of: hermes
automountServiceAccountToken: false
# Intentionally no RoleBinding or ClusterRoleBinding. The projected, bounded
# token is mounted only into Vault-facing containers and grants no Kubernetes
# API verbs to the model-facing execution worker.