Permissions for automation user to run cmk-agent-ctl register?

yeah, only now you can at least create multiple automation users that don’t all have access to “all hosts” but limit them to some host. However, I still believe registering/pairing an agent for TLS communication should be possible without “write access” to the host.

@AndiU would that be possible?