Solutions
One doctrine, scored the same way on every machine.
A written policy that nothing checks is a document. A pack of shell probes is the same policy with a number attached, and the number moves for reasons anyone on the team can read.
Bring your own pack
Every rule is an editable shell probe. Write the team's rules, weight them by what they cost when they fail, and the score follows your pack rather than ours.
A profile per agent
Each agent gets its own gateway endpoint and key. If one leaks, revoking that profile affects nothing else — and an agent is never shown tools for an account it may not use.
Changes become events
A settings file whose fingerprint moved, a hook that disappeared, a policy edited with nobody at the keyboard. Named at the next scan rather than at the next review.
Accounts linked once, not once per agent
The usual shape is every agent holding its own Google, Microsoft, Notion and Slack grants, which means the answer to what can our agents reach lives in four consoles and three laptops. The policy engine is one local endpoint every agent points at: accounts linked once, then per agent what it may see and what it may do there, default deny, scoped and expiring grants, and an audit line per call.
The uncomfortable part, first
There is no fleet console. Each machine scores itself locally and keeps its own history; nothing is uploaded, there is no account, and no central place shows you nine laptops at once. That is a deliberate consequence of a product whose argument is that nothing leaves your machine, and it is the thing to weigh before rolling this out to a team.
What travels is the pack. A rule file is text: check it in, review it the way you review anything else, and everyone runs the same probes and gets a number computed the same way. What does not travel is the result.
The failure a team actually hits
Not an exploit. An allow list that held 85 entries after a cleanup and 107 thirteen days later, each entry a reasonable click at the time, one of them a network tool that turned broad read access into a way off the machine. Nothing reviews the list as a whole — every approval is judged on its own, never against what is already granted. Written up, with the fix.