[fabijanbajo]

the credentials-out-of-the-sandbox part is the easy half. the quieter failure is a tool that holds no keys and still renders rows this particular employee was never meant to see.. sign-in proves who someone is, it doesn't scope what the query returns.

does the scoped token narrow to the requesting user, or is it one service identity per connector with the row filtering left to whatever the agent generated?