Because service accounts are assigned to applications when they are installed, a complete service account flow should make use of a permission model to configure the behavior of an application and determine when it should act using its service account and when it should request an OnBehalfOfToken.