How much breaks, or can be damaged, when one thing goes wrong. You reduce it by scoping permissions, isolating tenants and limiting what one agent run can touch.
You have done this if
You limited an agent to one project's repositories so a bad run could not touch the rest.
Say it in a review
A compromised agent token can only reach the one workspace it was issued for.