remove fallback to default sa

server/auth/gatekeeper.go

@@ -307,7 +307,8 @@ func (s *gatekeeper) rbacAuthorization(ctx context.Context, claims *types.Claims
 		namespaceAccount, err := s.getServiceAccount(claims, getNamespace(req))
 		if err != nil {
 			log.WithError(err).Info("Error while SSO Delegation")
-		} else if precedence(namespaceAccount) > precedence(loginAccount) {
+			return nil, err
+		} else {
 			delegatedAccount = namespaceAccount
 			ssoDelegated = true
 		}