The agent that cannot hurt you.

Security teams ask the same first question: what can this thing do to our cluster? Answer: it can look, and only look. Here is the actual permission set, verbatim from the Helm chart every customer installs.

# The agent's ClusterRole — enumerated, never wildcarded.
#
# There is no `secrets` rule and no `configmaps` rule. That is the point:
# people put credentials in both, and an agent that cannot request them
# cannot leak them regardless of what its code does. The permission
# boundary enforces the promise instead of relying on the implementation.
#
# Verbs are get/list/watch only. The agent never creates, updates,
# patches, or deletes anything.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
rules:
  - apiGroups: [""]
    resources: [pods, services, endpoints, namespaces, nodes]
    verbs: [get, list, watch]
  - apiGroups: [apps]
    resources: [deployments, statefulsets, daemonsets, replicasets]
    verbs: [get, list, watch]
  - apiGroups: [policy]
    resources: [poddisruptionbudgets]
    verbs: [get, list, watch]
  - apiGroups: [autoscaling]
    resources: [horizontalpodautoscalers]
    verbs: [get, list, watch]
  - apiGroups: [networking.k8s.io]
    resources: [ingresses]
    verbs: [get, list, watch]