No shell.
No vague roles.
No silent access.

Every authenticated request becomes one named capability against one repository and, when relevant, one reference.