Comment by HumanOstrich

As stated in the second paragraph of TFA, the machine workloads get their own infrastructure identity. Each identity can have different policies and permissions.