We let our cloud agents query prod (with OIDC, not secrets)