# Agent access review — sources and limits

Rethinking Agents · v0.2 · Checked September 17, 2026

Resource: https://rethinkingagents.com/resources/agent-access-review

## R01 — Repository-scoped personal credentials

GitHub. *Managing your personal access tokens*. GitHub Docs, undated living documentation. Sections: fine-grained personal access tokens, limitations, creating a token.
https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens

Directly checked: repository/permission restriction, retained public-repository reads and endpoint limitations. Primary documentation; high confidence in the documented mechanism, no evidence about an actual connector's grant. Refresh on authentication mode, endpoint or scope change.

## R02 — Installation-token grants

GitHub. *Generating an installation access token for a GitHub App*. GitHub Docs, undated living documentation. Section: generating an installation access token.
https://docs.github.com/en/apps/creating-github-apps/authenticating-with-a-github-app/generating-an-installation-access-token-for-a-github-app

Directly checked: repository and permission parameters narrow the token; omitted restrictions inherit installation/app grants. Primary documentation; no token issued or broker inspected. Refresh before using this mechanism in an implementation guide.

## R03 — Different tool boundaries

Anthropic. *Configure the sandboxed Bash tool*. Claude Code Docs, undated living documentation. Sections: filesystem isolation, scope and exceptions.
https://code.claude.com/docs/en/sandboxing

Directly checked: filesystem read/write controls and tool scopes are distinct. Primary documentation; not verification of an installed client. This is an example supporting separate route review, not a universal prescription. Refresh for the exact product version before configuration advice.

## Related analysis and original contribution

Task authority: https://rethinkingagents.com/blog/permission-for-the-wrong-thing
Sandbox boundaries: https://rethinkingagents.com/blog/what-your-sandbox-contains

The task, map, review procedure, fictional packet and proposed checks are original illustrative analysis. No private integration was inspected, and no behavior checks were run. Settings are configured evidence; recorded operations are observed evidence. Neither alone demonstrates complete containment. No reader-adoption, time-saving or security-effectiveness claim has been established.