The implicit permissions of a service account in Kubernetes

A fresh Kubernetes service account with zero Roles and zero RoleBindings still isn't powerless. Here's what permissions it actually has by default — and where they come from in the source code.