There may be a new finer grained role available, and we can assign to the created agents identity - no longer the shared project identity.