It would be great to add a View only permission or at least have the option to block the “Agent Download” option. Since if someone without deployment permissions downloads the agent with the onboarding option checked, can run the script and onboard a server or a computer that shouldn’t be onboarded.
It’s a big risk.