OptionaldescriptionNamespace id the service account is scoped to — <name>.<account>, e.g.
platform-dev.qebt8. namespaceScopedAccess is immutable after creation
and mutually exclusive with account-level access, so this identity can
never be widened to another namespace without being recreated.
OptionalnameDisplay-name suffix disambiguating environments, e.g. the stack name.
Appended as <name>-<suffix> on the Temporal-side resources.
OptionalnowThe clock the key rotation reads. Defaults to now; a test passes its own.
OptionalpermissionNamespace-scoped permission. Default "write" — services either start
workflows or poll and complete them; none is read-only.
Temporal Cloud provider, whose key is Namespace Admin of namespaceId.
Optional human description carried onto both resources.
PRINTABLE ASCII ONLY. Temporal Cloud validates this server-side with go-playground's
printasciiwstag (0x20–0x7E plus whitespace), and rejects anything else withField validation for 'Description' failed on the 'printasciiws' tag— which names neither the character nor its offset. An em dash, curly quote or ellipsis picked up from surrounding prose is the usual culprit.