Shared service accounts create shared blindness
One account for every automation makes governance analytics optional theatre.
Application teams serving Hong Kong clients often inherit a single automation credential that pre-dates the current control framework. Every pipeline inherits that blindness.
Separating accounts by environment is table stakes. Separating tags by policy and data domain is what lets governance analytics survive the next launch. Control Signal Attribution starts there.
Before celebrating a drop in exceptions, list which accounts and tags changed beside the chart. Access hygiene and genuine thrift look identical until you can tell them apart.