It’s great but how can it help with agent’s permissions for cloud services without fine grained tokens?