## Problem Service Accounts can generally be renamed, which also extends to the ones being used for Duo Agent Platform. This could lead to a lot of confusion, if an account associated with e.g. the ai-codex-review external agent is suddenly renamed. ## Desired Outcome Service Accounts created for composite ID cannot be renamed post creation. These would have the value composite_identity_enforced: true set. ## Implementation TBD