The automation account with god rights is every PKI's quietest liability: it exists because minting a narrow credential was harder than reusing a wide one. goca inverts that cost.
Look at how the product treats its own automation. The ACME head authenticates to the core with a scoped bearer token; the bundle's dev token only works with the dev master secret, and with a real secret you mint a purpose-built one:
curl -sk -H "$A" -d '{"name":"acme-head","roles":["acme-head"],
"templates":["*"]}' $API/v1/auth/tokens
— then mount it as a file (GOCA_ACME_API_TOKEN_FILE). A name, a role, a template scope: the token can do its one job and nothing else.
Enrollment credentials — for the machines that request certificates — follow the same discipline with a still-tighter grip: scope may include endpoint, templates, identifier patterns, expiry and use count; the secret is shown once and the core stores only a keyed hash. Redemption yields a stable requestor identity that template allowlists, approvals and audit all use, and mint, redeem, refuse and revoke are audit events.
The pattern to carry away: every credential names what it may touch, and the narrow one is the cheap one.
Now I can mint a token that can do its one job — and nothing else.