As stated in the second paragraph of TFA, the machine workloads get their own infrastructure identity. Each identity can have different policies and permissions.
We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).