As stated in the second paragraph of TFA, the machine workloads get their own infrastructure identity. Each identity can have different policies and permissions.
Yes, exactly, a cloud agent always authenticates itself (via OIDC) as an agent (machine) identity, with the option for the identity of the human who launched it to ride along.
We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).
We then have the ability to enforce (extremely fine grained) policies based on that combined identity, plus any of the claims in the OIDC token (e.g., the repo URL), plus any of the data on the protocol itself (e.g., block non-read-only queries; redact anything sensitive).
https://docs.formal.ai/docs/guides/policies/introduction