Reading this made me appreciate one subtle upside of cloud agents a bit more. The credential setup can be annoying, but it’s also a useful bit of friction.
A local agent may accidentally inherit all the random authority sitting on your laptop: env vars, cloud CLIs, ~/.aws, ~/.ssh, forgotten tokens, etc. With a cloud agent, you’re usually much more deliberate about what credentials it gets.