Access is decided on the server by membership, and to anyone else your project looks exactly like one that does not exist, with the same not-found answer. Knowing the site's name or holding its FTP password grants nothing in SyncNow.
Each role carries a fixed set of capabilities, such as source.read, source.write, db.read or secret.manage. An agent works with short-lived capabilities for one project, lasting between one minute and one hour, limited to what the role of the team member it works for allows and never including administration, secret management or deploy configuration.
Every use is checked again: signature, expiry, revocation and membership, so a removed manager's agents are stopped at their next request, and a capability tied to an agent session stops working when the session ends. The roles are described in What can a manager do on my project?.