We should implement service accounts: accounts that are created at Ipsilon itself (not self-service, by the admin), that have a particular set of scopes they can request OIDC tickets for.
Metadata Update from @t0xic0der: - Issue close_status updated to: Fixed - Issue status updated to: Closed (was: Open)