Be careful not to restrict the agent, which uses the default account (/AgentSetup/defaultAccount), or the configuration utilities (xpconfig, wpconfig, and pconfig) from performing configuration changes on the agent.
To be able to configure an agent and run KM scripts that contain the pconfig( ) function, the default account must have configuration access from the host on which the agent is running.
"/AgentSetup/accessControlList" = {REPLACE="defaultAccount/*/C, logonAccount/*/C"}