Clarification about accounts and extensions

I want to get some clarification on account structure, and how it relates to data we get back from the RingCentral api.

1. Are there just two levels of account structure: Account-> Extensions (One main account identifier, and multiple extension identifiers underneath that)? Or, are there more levels?
2. When performing the 3-legged OAuth sequence, we are getting back one identifier: when getting the token (https://platform.ringcentral.com/restapi/oauth/token), we get back "owner_id" among other things. Second, we make a call to extension endpoint (https://platform.ringcentral.com/restapi/v1.0/account/~/extension/~) to retrieve more account info. From this second call, we get back "id" and "account.id". Does "owner_id" == "id", or does "owner_id" == "account.id", or is "owner_id" a completely separate identifier from the other two?
3. Does a service account have it's own identifier within the context of the api? I ask this question because I have created a service account for testing. But when I log in to our app integration with that service account, I am getting the same identifiers as my main Super User account (in the "owner_id", "id", and "account.id" fields).

My main goal here is to be able to distinguish between different accounts while maintaining their relationship to the parent account when logging into our app integration using both regular extensions as well as service accounts.