Clarity on Agent Access Token Scope

Hey! I was hoping to get some clarity on [Scope of Access](https://buildkite.com/docs/agent/v3/tokens#scope-of-access). In the doc, it describes that an agent access token can be used to register an agent to a queue. What else can it (or the session token) do? Can it

* Arbitrarily set meta-data on any job?
* Arbitrarily upload artifacts to any job?
* Upload additional steps to any job, or just those that are already given to it?
* None of these things?

Thanks!

Start with the linked Scope of Access section in the agent token documentation and review the existing descriptions of agent access and session tokens. Determine the documented permissions for metadata, artifact uploads, and uploading steps, then update the documentation so each of the four questions has an explicit answer.

Written by the indexing model from the issue text.