Scope an agent's permissions to its credential, not to its runtime — NullRun