Machines are principals too
A payroll process, ingestion service or archive job can have a legitimate need to read or write sensitive content. That does not make it an employee, and it should not need a copied human session to operate.
A machine principal gives the automation a stable identity that can be scoped and audited independently.
Scope the actions to the job
The payroll service may need to read a compensation file but have no reason to create an external share. The same action-and-resource policy model used for people can express that distinction for automation.
This reduces the blast radius of a compromised credential and makes service ownership clearer.
Audit should show automation as automation
When a machine changes content or metadata, the audit record should identify the machine principal rather than attributing the action to whichever engineer created the token months earlier.
That distinction is invaluable during incident response and operational troubleshooting.
Scope the job
Give automation its own enrolled identity and limit it to the actions the job needs. A shared human password collapses audit and revocation when something goes wrong.