Why one permission switch is insufficient
An Agent credential, a cloud policy and a local machine answer different questions. Who owns the resource? Which Agent may request work? What has the device owner exposed right now? Which tool does the live Connector actually support?
Collapsing those answers into one broad role makes drift hard to see and revocation hard to reason about. ADC evaluates them as independent layers and allows work only through their intersection.
The five effective boundaries
Account ownership prevents cross-account access. An Agent authorization selects devices, folders and tools. Device policy can make exposed folders read-only or disable execution. Local Connector scope determines which paths are disclosed. Live capability confirms that the requested tool is currently available.
- No layer can expand a narrower layer.
- The device revalidates paths immediately before execution.
- Policy changes apply to new work immediately.
- Active work is checked again during lease renewal.
Approval is not capability
An approval policy answers whether a permitted operation needs a human decision. It cannot make a denied tool, device or path available. Keeping approval independent prevents a click from silently widening the underlying grant.
A workable least-privilege routine
Create one authorization per Agent role, start with one device and selected folders, and enable only the tools required for the first task. Review denials as evidence of a missing need, not as a reason to switch immediately to full trust.
When an Agent no longer needs access, revoke the authorization. Its CLI credentials and OAuth bindings become invalid without rotating unrelated users or devices.