You can now use workload identity when defining IAM policies to grant a workload fine-grained access to Oracle Cloud Infrastructure resources (such as Object Storage buckets) that are in a different tenancy or compartment to the cluster on which the workload is running.

This feature is particularly useful if your organization has users with different responsibilities for organizing OCI resources and policies (for example, a cluster administrator and a tenancy administrator).

For more information, see Granting Workloads Access to OCI Resources.