Using custom SAs is the best practice when deploying to Google Cloud services. Agent Engine recently introduced [this ability](https://cloud.google.com/vertex-ai/generative-ai/docs/agent-engine/deploy#service-account).