Hi! We are looking into creating a Kratos identity for service accounts. We want to prevent that schema to be used during self-service and it should not have any updatable traits. I don't really find a way to do that with Identities today, and there's basically no docs for it. Do you have any pointers? I want to make sure that the one who authenticates with the SA basically has no update rights