One person proposes a machine identity and another approves it.
As pki-admin
Open /nhi
Click Propose identity
Fill Name with "billing-bot"
Select "service_account" in select
Tick certificate.read
Click Propose
As approver
Click Approve billing-bot