diff --git a/src/mcpd/tests/server-identity-service.test.ts b/src/mcpd/tests/server-identity-service.test.ts
new file mode 100644
index 0000000..f72d818
--- /dev/null
+++ b/src/mcpd/tests/server-identity-service.test.ts
@@ -0,0 +1,117 @@
+/**
+ * Per-server identity provisioning. The property under test throughout is
+ * CONTAINMENT: a server's identity must grant exactly its own secrets, because
+ * the alternative (one shared role) would let third-party MCP images read every
+ * secret under the prefix — worse than the pod-spec exposure it replaces.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import type { SecretBackend } from '@prisma/client';
+import { ServerIdentityService, type ServiceAccountPort } from '../src/services/server-identity.service.js';
+import type { SecretBackendService } from '../src/services/secret-backend.service.js';
+import type { SecretBackendDriver } from '../src/services/secret-backends/types.js';
+
+const NS = 'mcpctl-servers';
+
+function envRef(name: string, secret: string, key: string): unknown {
+  return { name, valueFrom: { secretRef: { name: secret, key } } };
+}
+
+function harness(driverOverrides: Partial<SecretBackendDriver> = {}, backendType = 'openbao') {
+  const calls = { sa: [] as string[], saRemoved: [] as string[] };
+  const ensureServerIdentity = vi.fn(async () => undefined);
+  const removeServerIdentity = vi.fn(async () => undefined);
+  const driver = { kind: backendType, ensureServerIdentity, removeServerIdentity, ...driverOverrides } as unknown as SecretBackendDriver;
+
+  const backends = {
+    getDefault: async (): Promise<SecretBackend> => ({ id: 'b1', name: 'bao-k8s', type: backendType } as SecretBackend),
+    driverFor: () => driver,
+  } as unknown as SecretBackendService;
+
+  const serviceAccounts: ServiceAccountPort = {
+    namespace: NS,
+    ensure: async (n) => { calls.sa.push(n); },
+    remove: async (n) => { calls.saRemoved.push(n); },
+  };
+
+  return { svc: new ServerIdentityService(backends, serviceAccounts), calls, ensureServerIdentity, removeServerIdentity };
+}
+
+describe('ServerIdentityService', () => {
+  it('grants a server exactly the secrets it declares', async () => {
+    const h = harness();
+    await h.svc.ensureFor({
+      name: 'gitea',
+      env: [envRef('GITEA_ACCESS_TOKEN', 'gitea-creds', 'GITEA_ACCESS_TOKEN'), envRef('GITEA_HOST', 'gitea-creds', 'GITEA_HOST')],
+    } as never);
+
+    expect(h.ensureServerIdentity).toHaveBeenCalledWith({
+      name: 'mcpctl-server-gitea',
+      namespace: NS,
+      // One secret, not two: the same secret referenced twice is one grant.
+      secretNames: ['gitea-creds'],
+    });
+  });
+
+  it('does not leak another server\'s secrets into the grant', async () => {
+    const h = harness();
+    await h.svc.ensureFor({ name: 'gitea', env: [envRef('T', 'gitea-creds', 'K')] } as never);
+    const granted = h.ensureServerIdentity.mock.calls[0]?.[0] as { secretNames: string[] };
+    expect(granted.secretNames).not.toContain('unifi-creds');
+    expect(granted.secretNames).not.toContain('anthropic-key');
+  });
+
+  it('ignores inline env values — they are not secrets', async () => {
+    const h = harness();
+    await h.svc.ensureFor({
+      name: 's',
+      env: [{ name: 'PLAIN', value: 'not-a-secret' }, envRef('T', 'real', 'K')],
+    } as never);
+    const granted = h.ensureServerIdentity.mock.calls[0]?.[0] as { secretNames: string[] };
+    expect(granted.secretNames).toEqual(['real']);
+  });
+
+  it('creates the ServiceAccount BEFORE binding the role to it', async () => {
+    // Reverse order lets the pod start, fail to log in, and crashloop while the
+    // role is still being written.
+    const order: string[] = [];
+    const h = harness();
+    const svc = new ServerIdentityService(
+      { getDefault: async () => ({ id: 'b1', name: 'bao', type: 'openbao' } as SecretBackend),
+        driverFor: () => ({ kind: 'openbao', ensureServerIdentity: async () => { order.push('role'); } }) } as unknown as SecretBackendService,
+      { namespace: NS, ensure: async () => { order.push('sa'); }, remove: async () => undefined },
+    );
+    await svc.ensureFor({ name: 'x', env: [envRef('T', 's', 'K')] } as never);
+    expect(order).toEqual(['sa', 'role']);
+    expect(h).toBeDefined();
+  });
+
+  it('produces an empty grant for a server with no secret refs', async () => {
+    const h = harness();
+    await h.svc.ensureFor({ name: 'plain', env: [] } as never);
+    const granted = h.ensureServerIdentity.mock.calls[0]?.[0] as { secretNames: string[] };
+    expect(granted.secretNames).toEqual([]);
+  });
+
+  it('refuses on a backend that cannot scope identities, rather than silently succeeding', async () => {
+    // A plaintext backend has no auth mount to bind a role on. Succeeding here
+    // would leave a pod believing it had been granted access it never got.
+    const h = harness({ ensureServerIdentity: undefined }, 'plaintext');
+    await expect(h.svc.ensureFor({ name: 's', env: [] } as never))
+      .rejects.toThrow(/cannot provision per-server identities/);
+  });
+
+  it('revokes the OpenBao identity and the ServiceAccount on removal', async () => {
+    const h = harness();
+    await h.svc.removeFor('gitea');
+    expect(h.removeServerIdentity).toHaveBeenCalledWith({ name: 'mcpctl-server-gitea' });
+    expect(h.calls.saRemoved).toEqual(['mcpctl-server-gitea']);
+  });
+
+  it('still removes the ServiceAccount when OpenBao teardown fails', async () => {
+    // A half-removed identity grants nothing useful; abandoning the rest would
+    // strand the k8s side.
+    const h = harness({ removeServerIdentity: vi.fn(async () => { throw new Error('bao down'); }) as never });
+    await expect(h.svc.removeFor('gitea')).resolves.toBeUndefined();
+    expect(h.calls.saRemoved).toEqual(['mcpctl-server-gitea']);
+  });
+});