Restrict deployment identity to the reviewed workflow

A definition earns nothing in the room. What is worth holding is the shape underneath it: what this mechanism buys, what it charges you for that, and the one condition that decides whether it applies here at all.

Then follow one real example the whole way through and say how it fails, because naming the failure is what separates having operated this from having read about it.