Service accounts are normally used by applications (compute workload) to authenticate with Google Cloud services. In other words, your application can access Google Cloud resources on behalf of the service account. In essense, your application impersonates the service account.

Service accounts also support OpenID Connect, so you can also use them to authenticate between your own services.