A service manager turns process startup, failure, and shutdown into observable state transitions. With systemd, a unit can name the foreground command, its restart policy, and its output destination. That removes the need for a shell loop that repeatedly launches a daemon without recording why it stopped. It does not prove that the running application can answer requests or that restarting repairs the underlying fault. ...
A scheduler starts attempts, while the business usually cares about completing a logical task. One daily credit may be attempted several times after an error, a restart, or an operator retry. Giving every attempt a new identifier makes those duplicates indistinguishable from new work. Use a key that identifies the intended task, such as its name and nominal scheduled time, and define what a repeated key means before changing business state. ...
Least privilege means granting a principal the operations required for a defined job, on the intended resources, for an appropriate lifetime. It is a testable policy rather than a reassuring label. Start with the service’s real launch identity and dependencies; an unused permission and a missing permission are different findings that need different responses. ...