u/Front-Cheetah-4980

I'm struggling with what happens when an agent gets denied halfway through a task. With a person, a permission failure is annoying but they can stop and deal with it. An agent might already be several steps into a workflow and leave things half finished. I still want access denied unless the agent is supposed to have it, but I'm trying to figure out how people do that without turning every permission change into another broken workflow.

We started with the governance features from one of our cloud providers because most of our agents were running there. Now different teams are deploying across multiple clouds and frameworks, so those controls only cover part of what we're running.

I'm trying to move toward something that isn't tied to where the agent runs. We need consistent access control across all of them without rebuilding the same rules for every environment.