- supports two initial scenarios - 2LO with service accounts - Compute Engine - performs all 3 'sniffs' for the service account credentials - from environment - from a well known file - from GCE