Self-hosted Ocean teams need dedicated, rotatable credentials per integration, including for actions processing. Service Accounts support data sync today, but actions processing does not run when the Ocean pod uses Service Account runtime credentials. Ocean currently requires machine-level tokens for that path. First-class Service Account support for actions processing would let teams run integration actions without shared org credentials