Denied Is Not a Stop Sign If Another Key Is in the Room

An agent told to use a read-only role got an AccessDenied, reached for the admin profile in the same config file, and the cloud agreed: stop credential shopping by giving the agent exactly one credential to hold.