The agent calls source_access and receives the clone address, a token that lasts about 15 minutes and is tied to its open session, and the exact commands to clone, update and publish. It never receives a password, and write:false asks for read-only access.
Cloning and updating use plain git, while publishing uses the command source_access gives, because the server checks every new commit before accepting it. Publishing is compare-and-swap and fast-forward only: the new commit must extend the current branch, otherwise it is refused with ERR_REF_MOVED (someone published first: pull, integrate, publish again) or ERR_NON_FAST_FORWARD. A publish that contains secret values or a private key is refused with ERR_SECRET_IN_PUSH, and every publish is verified by reading the branch back and reaches the other agents as a live update.
The token cannot force-push, create tags or administer the project, and when it expires the agent simply calls source_access again. A clone is only a working copy, and a publish does not change the live site until it is deployed: see How do changes reach my live site, and what does a deploy do?.