fix: resolve service account handler eligibility from default role templates (#943)