Currently an Agent can only be used by CI jobs that are running
in the Agent's configuration project. However, an agent can be
configured to allow access at the group level, and these groups
are not currently considered when generating the list of allowed
agents.

When an Agent is configured to allow access from a group, it
becomes available to all projects within that group and subgroups.
If a project would have access to the same Agent through multiple
groups due to authorizations at multiple levels in the hierarchy,
the authorization closest to the project (the lowest level) is used.

An Agent is only available if it is within the hierarchy of the
the requesting project.

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/69047