Function operator_peer_allowed 

pub fn operator_peer_allowed(
    peer_uid: u32,
    peer_gids: &[u32],
    server_uid: u32,
    operator_gid: Option<u32>,
) -> bool

Whether a connecting peer may use a command-plane socket.

Root always may. So may a peer running as the same uid as the serving process: every agent service runs as root, so on a node this adds nothing, and on a dev host it lets the owning user’s own tools in. Anyone else must carry the operator group, primary or supplementary. With the group absent from the host (operator_gid is None) nobody else is admitted.

Pure over the kernel-reported credentials so the decision is testable without a second uid.