Create employee accounts one by one or import them from a CSV file. They sign in on your workspace's own page with an emailed code, an authenticator app or a passkey, never a password. When someone leaves, removing the account ends every session, token and SSH key at once, while their commits and reviews stay.
Managed accounts use the same roles, custom roles, teams and repository grants as everyone else, under your workspace's required two-factor, session limits and audit log.
Fine-grained Git permissions →Give each agent a service account, limited to the repositories that hold the code, instructions and skills it works from. Its work shows under its own name, and a person still approves what it opens.
Service accounts →