So the agent still needs to hook into something with elevated privileges to install packages, just that instead of having granular control in the package manage

So the agent still needs to hook into something with elevated privileges to install packages, just that instead of having granular control in the package manager, it has moved to server side with an RBAC/HBAC tie-in. I agree that it solves practical issues, but it would be nice to not have privileged access at all. Also, doesn't it create friction if you don't have a package in your repos ?