You need to configure the distribution agent by granting only the minimum required access to all accounts