From the KC mailing list :
"We'll be adding service accounts in the near future, that'll provide a way for clients to obtain a token on behalf of themselves. There will be a special linked user to the client. Clients can obtain this through the client credential grant (see oauth2 for more details) and use a secret or pub/priv keypair to authenticate.

For a client to get a token on behalf of a user the user will have to either enter username/pass in a cli and you'd use resource owner credential grant (again see oauth2 for more details) or you'd use the normal redirect based flow."

That would be useful for UPS integration with other systems.