Hey !

I guess most of us have a lot of admin accesses to tools like AWS, k8s clusters, Datadog, GitHub etc.

How do you contain your agents to read-only or curated permissions? Without restraining your own accesses.

I do have some sort of hook as a guard + a setup on pi.dev that copy my config and extract the read-only accesses only to do so, but it's never completely opaque.