resourcequota enforces all incoming requests against any applied quota in the namespace context of the request.

serviceaccount enforces all pods having an associated serviceaccount, and all containers mounting the API token for that serviceaccount at a known location.