Workflows uses service accounts to give workflows access to Google Cloud resources. Service accounts are special accounts that serve as the identity of a non-person, like a function, an application, or a VM. They give you a way to authenticate these non-persons. A service account can be thought of as both an identity and a resource.
When thinking of a service account as an identity, you can grant a role to a service account, allowing it to access a resource (such as a workflow).
When thinking of a service account as a resource, you can grant roles to other users to access or manage that service account.
A service account is identified by its email address, which is unique to the account.
For more information about setting up authentication with a production application, see Authenticate as a service account.