{
  "type": "profile/v1",
  "id": "generic/scheduled-job/service-account",
  "vendor": "generic",
  "product": "A scheduled job running as a service account",
  "variant": "service-account",
  "surface": "service",
  "version": "2026-09-05",
  "description": "A cron job or scheduled task on a server, under an account that is not a person's, with a credential nobody rotates. It runs when nobody is watching and no person's judgement stands in front of it. DERIVED; not measured on any instance.",
  "reach_names": {
    "host": "the server it runs on, as the service account",
    "tenant": "whatever the service account's credential opens",
    "world": "the internet, from the server"
  },
  "not_reachable": [
    {
      "what": "your machine",
      "why": "it runs on a server",
      "source": "by construction"
    }
  ],
  "refine": {
    "execute.process.host": "proc:server",
    "write.file.host": "fs:server-disk",
    "read.file.host": "fs:server-disk",
    "authenticate-as.credential.tenant": "id:service-account",
    "send.endpoint.world": "net:world",
    "create.schedule.host": "sched:host-cron",
    "write.budget.tenant": "money:metered-account"
  },
  "tools": [
    {
      "tool": "the job",
      "evidence": null,
      "grant": [
        {
          "capability": "execute.process.host",
          "tier": "derived",
          "control": null,
          "control_tier": "none",
          "note": "as the service account, on a schedule"
        },
        {
          "capability": "read.file.host",
          "tier": "derived",
          "control": null,
          "control_tier": "none"
        },
        {
          "capability": "write.file.host",
          "tier": "derived",
          "control": null,
          "control_tier": "none"
        },
        {
          "capability": "authenticate-as.credential.tenant",
          "tier": "derived",
          "control": null,
          "control_tier": "none",
          "note": "a service-account credential, rarely rotated"
        },
        {
          "capability": "send.endpoint.world",
          "tier": "derived",
          "control": null,
          "control_tier": "none"
        },
        {
          "capability": "create.schedule.host",
          "tier": "derived",
          "control": null,
          "control_tier": "none",
          "note": "it is one"
        },
        {
          "capability": "write.budget.tenant",
          "tier": "derived",
          "control": null,
          "control_tier": "none",
          "note": "if the credential is billed"
        }
      ]
    }
  ],
  "sources": [
    "brief v0.33.65: things nobody calls an agent \u2014 a scheduled job with a service account"
  ],
  "prior": 0.02,
  "union": [
    "authenticate-as.credential.tenant",
    "create.schedule.host",
    "execute.process.host",
    "read.file.host",
    "send.endpoint.world",
    "write.budget.tenant",
    "write.file.host"
  ],
  "intersection": [
    "authenticate-as.credential.tenant",
    "create.schedule.host",
    "execute.process.host",
    "read.file.host",
    "send.endpoint.world",
    "write.budget.tenant",
    "write.file.host"
  ],
  "irreversible_in_union": [
    "authenticate-as.credential.tenant",
    "read.file.host",
    "send.endpoint.world",
    "write.budget.tenant"
  ]
}