Per the title, this issue describes a feature where plugins are assigned a service account during the bootstrap process. This account should then be associated with that application and it should be possible to identify when a plugin is using the Service Account or not.

Permission assignment is outside the scope of this issue since retroactively assigning permissions to plugins is not straightforward.