**ServiceAccount** — Identity for pods - **Role / ClusterRole** — Defines permissions (verbs on resources) - **RoleBinding / ClusterRoleBinding** — Associates roles with subjects