The safest agent I had was the one that couldn’t help anybody. Authority used to attach to the agent, because there was nothing smaller to attach it to – restrict a worker, and you restricted it everywhere. A project is smaller. In v1.17 a project can have members, so a token can be trusted inside one piece of work without being trusted across the whole instance.