the scope problem is actually worse with agents than with github.dev. the architectural answer is the same though: the credential the agent operates with should be scoped to the task and expire when the task ends.