You can create a “service account” in manager, similar to how developer users are created, but there is a checkbox that differentiates it. The service account password email will be sent to the admin user that created the account to enable password reset. You can also deny UI access from the service account.
You then just need to grant Read+Execute access for the service account to be able to execute the pipelines via triggered or scheduled tasks.
FYI - you can also use the bearer token authentication on triggered tasks to run the pipeline as the user who created the task. You will want to have your admin do the migrations to higher environments so you don’t need to grant your developers with write access in those orgs and so that the tasks will execute with an appropriate permissions level when using the bearer token.
