Agents read the network. They never change it.

A wrong network change hurts every customer at once, so this team gets the tightest rules of the three.

Read-only access
Probes and queries only. There is no tool that edits a route, a setting or firmware.
Engineer owns the fix
The agent suggests. A named engineer approves and carries it out.
Approved words only
Status updates and support scripts are drafts until a person signs off.

Probes are rate-limited so the watcher can't add load during an incident. The shared rules are on the governance page.