Identity tokens work in a scheduled job's run
identity_token() in a job answered identity_refused (403) because the run read a token left from the sandbox's warm start. The command now gets the sandbox's current identity-token request token, as a command in the sandbox does. See identity tokens.