Can the SSH agent bypass biometrics for service accounts?

I have an SSH key in a vault that’s accessible to a service account. I run scripts that use that service account to access secrets needed for “batch” (non-interactive) operations like backups. 

However, even though OP_SERVICE_ACCOUNT_TOKEN is set and the scripts can access other secrets in the same vault, the SSH agent wants biometric verification if the scripts attempt to run ssh or sftp.

Is this expected behavior? The SSH agent doesn’t “see” the service account token?

I worked around it by tweaking ~/.ssh/config to use a file-based key for those scripted situations, but I’d like to make sure I haven’t misconfigured something.

Thanks.