diff --git a/apis/core/v1alpha1/zz_generated.deepcopy.go b/apis/core/v1alpha1/zz_generated.deepcopy.go
index 82e6b79..9bd0ba0 100644
--- a/apis/core/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/core/v1alpha1/zz_generated.deepcopy.go
@@ -172,7 +172,7 @@ func (in *ClusterObservationStatus) DeepCopy() *ClusterObservationStatus {
 func (in *ClusterParameters) DeepCopyInto(out *ClusterParameters) {
 	*out = *in
 	out.InstanceRef = in.InstanceRef
-	out.ClusterSpec = in.ClusterSpec
+	in.ClusterSpec.DeepCopyInto(&out.ClusterSpec)
 	if in.Annotations != nil {
 		in, out := &in.Annotations, &out.Annotations
 		*out = make(map[string]string, len(*in))
diff --git a/internal/types/generated/akuity/v1alpha1/argocdinstance_types.go b/internal/types/generated/akuity/v1alpha1/argocdinstance_types.go
index 9d5ffaf..a875643 100644
--- a/internal/types/generated/akuity/v1alpha1/argocdinstance_types.go
+++ b/internal/types/generated/akuity/v1alpha1/argocdinstance_types.go
@@ -58,6 +58,12 @@ type AppsetPolicy struct {
 	OverridePolicy bool   `json:"overridePolicy,omitempty"`
 }
 
+type AgentPermissionsRule struct {
+	ApiGroups []string `json:"apiGroups,omitempty"`
+	Resources []string `json:"resources,omitempty"`
+	Verbs     []string `json:"verbs,omitempty"`
+}
+
 type InstanceSpec struct {
 	IpAllowList                  []*IPAllowListEntry            `json:"ipAllowList,omitempty"`
 	Subdomain                    string                         `json:"subdomain,omitempty"`
@@ -74,6 +80,7 @@ type InstanceSpec struct {
 	AssistantExtensionEnabled    bool                           `json:"assistantExtensionEnabled,omitempty"`
 	AppsetPolicy                 *AppsetPolicy                  `json:"appsetPolicy,omitempty"`
 	HostAliases                  []*HostAliases                 `json:"hostAliases,omitempty"`
+	AgentPermissionsRules        []*AgentPermissionsRule        `json:"agentPermissionsRules,omitempty"`
 }
 
 type ManagedCluster struct {
diff --git a/internal/types/generated/akuity/v1alpha1/cluster_types.go b/internal/types/generated/akuity/v1alpha1/cluster_types.go
index 84a1b42..cd95838 100644
--- a/internal/types/generated/akuity/v1alpha1/cluster_types.go
+++ b/internal/types/generated/akuity/v1alpha1/cluster_types.go
@@ -23,6 +23,8 @@ type Cluster struct {
 
 type ClusterSize string
 
+type DirectClusterType string
+
 //+kubebuilder:object:root=true
 
 // ClusterList contains a list of Cluster
@@ -42,6 +44,13 @@ type ClusterSpec struct {
 	Data            ClusterData `json:"data,omitempty"`
 }
 
+type DirectClusterSpec struct {
+	ClusterType     DirectClusterType `json:"clusterType,omitempty"`
+	KargoInstanceId *string           `json:"kargoInstanceId,omitempty"`
+	Server          *string           `json:"server,omitempty"`
+	Token           *string           `json:"token,omitempty"`
+}
+
 type ClusterData struct {
 	Size                ClusterSize          `json:"size,omitempty"`
 	AutoUpgradeDisabled *bool                `json:"autoUpgradeDisabled,omitempty"`
@@ -49,4 +58,5 @@ type ClusterData struct {
 	AppReplication      *bool                `json:"appReplication,omitempty"`
 	TargetVersion       string               `json:"targetVersion,omitempty"`
 	RedisTunneling      *bool                `json:"redisTunneling,omitempty"`
+	DirectClusterSpec   *DirectClusterSpec   `json:"directClusterSpec,omitempty"`
 }
diff --git a/internal/types/generated/akuity/v1alpha1/zz_generated.deepcopy.go b/internal/types/generated/akuity/v1alpha1/zz_generated.deepcopy.go
index 1caf47d..7590022 100644
--- a/internal/types/generated/akuity/v1alpha1/zz_generated.deepcopy.go
+++ b/internal/types/generated/akuity/v1alpha1/zz_generated.deepcopy.go
@@ -9,6 +9,36 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentPermissionsRule) DeepCopyInto(out *AgentPermissionsRule) {
+	*out = *in
+	if in.ApiGroups != nil {
+		in, out := &in.ApiGroups, &out.ApiGroups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Verbs != nil {
+		in, out := &in.Verbs, &out.Verbs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentPermissionsRule.
+func (in *AgentPermissionsRule) DeepCopy() *AgentPermissionsRule {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentPermissionsRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AppSetDelegate) DeepCopyInto(out *AppSetDelegate) {
 	*out = *in
@@ -194,6 +224,11 @@ func (in *ClusterData) DeepCopyInto(out *ClusterData) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.DirectClusterSpec != nil {
+		in, out := &in.DirectClusterSpec, &out.DirectClusterSpec
+		*out = new(DirectClusterSpec)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterData.
@@ -254,6 +289,36 @@ func (in *ClusterSpec) DeepCopy() *ClusterSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DirectClusterSpec) DeepCopyInto(out *DirectClusterSpec) {
+	*out = *in
+	if in.KargoInstanceId != nil {
+		in, out := &in.KargoInstanceId, &out.KargoInstanceId
+		*out = new(string)
+		**out = **in
+	}
+	if in.Server != nil {
+		in, out := &in.Server, &out.Server
+		*out = new(string)
+		**out = **in
+	}
+	if in.Token != nil {
+		in, out := &in.Token, &out.Token
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectClusterSpec.
+func (in *DirectClusterSpec) DeepCopy() *DirectClusterSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(DirectClusterSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *HostAliases) DeepCopyInto(out *HostAliases) {
 	*out = *in
@@ -370,6 +435,17 @@ func (in *InstanceSpec) DeepCopyInto(out *InstanceSpec) {
 			}
 		}
 	}
+	if in.AgentPermissionsRules != nil {
+		in, out := &in.AgentPermissionsRules, &out.AgentPermissionsRules
+		*out = make([]*AgentPermissionsRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(AgentPermissionsRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstanceSpec.
diff --git a/internal/types/generated/crossplane/v1alpha1/argocdinstance_types.go b/internal/types/generated/crossplane/v1alpha1/argocdinstance_types.go
index 64c5f08..0a0935f 100644
--- a/internal/types/generated/crossplane/v1alpha1/argocdinstance_types.go
+++ b/internal/types/generated/crossplane/v1alpha1/argocdinstance_types.go
@@ -10,6 +10,11 @@ type ArgoCD struct {
 	Spec ArgoCDSpec `json:"spec,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type ArgoCDList struct {
+	Items []ArgoCD `json:"items"`
+}
+
 // +kubebuilder:object:generate=true
 type ArgoCDSpec struct {
 	Description  string       `json:"description,omitempty"`
@@ -25,10 +30,10 @@ type ArgoCDExtensionInstallEntry struct {
 
 // +kubebuilder:object:generate=true
 type ClusterCustomization struct {
-	AutoUpgradeDisabled bool                 `json:"autoUpgradeDisabled,omitempty"`
-	Kustomization       string               `json:"kustomization,omitempty"`
-	AppReplication      bool                 `json:"appReplication,omitempty"`
-	RedisTunneling      bool                 `json:"redisTunneling,omitempty"`
+	AutoUpgradeDisabled bool   `json:"autoUpgradeDisabled,omitempty"`
+	Kustomization       string `json:"kustomization,omitempty"`
+	AppReplication      bool   `json:"appReplication,omitempty"`
+	RedisTunneling      bool   `json:"redisTunneling,omitempty"`
 }
 
 // +kubebuilder:object:generate=true
@@ -37,6 +42,13 @@ type AppsetPolicy struct {
 	OverridePolicy bool   `json:"overridePolicy,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type AgentPermissionsRule struct {
+	ApiGroups []string `json:"apiGroups,omitempty"`
+	Resources []string `json:"resources,omitempty"`
+	Verbs     []string `json:"verbs,omitempty"`
+}
+
 // +kubebuilder:object:generate=true
 type InstanceSpec struct {
 	IpAllowList                  []*IPAllowListEntry            `json:"ipAllowList,omitempty"`
@@ -54,6 +66,7 @@ type InstanceSpec struct {
 	AssistantExtensionEnabled    bool                           `json:"assistantExtensionEnabled,omitempty"`
 	AppsetPolicy                 *AppsetPolicy                  `json:"appsetPolicy,omitempty"`
 	HostAliases                  []*HostAliases                 `json:"hostAliases,omitempty"`
+	AgentPermissionsRules        []*AgentPermissionsRule        `json:"agentPermissionsRules,omitempty"`
 }
 
 // +kubebuilder:object:generate=true
diff --git a/internal/types/generated/crossplane/v1alpha1/cluster_types.go b/internal/types/generated/crossplane/v1alpha1/cluster_types.go
index 3b83782..376ba76 100644
--- a/internal/types/generated/crossplane/v1alpha1/cluster_types.go
+++ b/internal/types/generated/crossplane/v1alpha1/cluster_types.go
@@ -7,11 +7,18 @@ package v1alpha1
 
 type ClusterSize string
 
+type DirectClusterType string
+
 // +kubebuilder:object:generate=true
 type Cluster struct {
 	Spec ClusterSpec `json:"spec,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type ClusterList struct {
+	Items []Cluster `json:"items"`
+}
+
 // +kubebuilder:object:generate=true
 type ClusterSpec struct {
 	Description     string      `json:"description,omitempty"`
@@ -19,12 +26,21 @@ type ClusterSpec struct {
 	Data            ClusterData `json:"data,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type DirectClusterSpec struct {
+	ClusterType     DirectClusterType `json:"clusterType,omitempty"`
+	KargoInstanceId *string           `json:"kargoInstanceId,omitempty"`
+	Server          *string           `json:"server,omitempty"`
+	Token           *string           `json:"token,omitempty"`
+}
+
 // +kubebuilder:object:generate=true
 type ClusterData struct {
-	Size                ClusterSize `json:"size,omitempty"`
-	AutoUpgradeDisabled bool        `json:"autoUpgradeDisabled,omitempty"`
-	Kustomization       string      `json:"kustomization,omitempty"`
-	AppReplication      bool        `json:"appReplication,omitempty"`
-	TargetVersion       string      `json:"targetVersion,omitempty"`
-	RedisTunneling      bool        `json:"redisTunneling,omitempty"`
+	Size                ClusterSize        `json:"size,omitempty"`
+	AutoUpgradeDisabled bool               `json:"autoUpgradeDisabled,omitempty"`
+	Kustomization       string             `json:"kustomization,omitempty"`
+	AppReplication      bool               `json:"appReplication,omitempty"`
+	TargetVersion       string             `json:"targetVersion,omitempty"`
+	RedisTunneling      bool               `json:"redisTunneling,omitempty"`
+	DirectClusterSpec   *DirectClusterSpec `json:"directClusterSpec,omitempty"`
 }
diff --git a/internal/types/generated/crossplane/v1alpha1/configmanagementplugin_types.go b/internal/types/generated/crossplane/v1alpha1/configmanagementplugin_types.go
index 7cd67b9..62ab046 100644
--- a/internal/types/generated/crossplane/v1alpha1/configmanagementplugin_types.go
+++ b/internal/types/generated/crossplane/v1alpha1/configmanagementplugin_types.go
@@ -12,6 +12,11 @@ type ConfigManagementPlugin struct {
 	Spec    PluginSpec `json:"spec,omitempty"`
 }
 
+// +kubebuilder:object:generate=true
+type ConfigManagementPluginList struct {
+	Items []ConfigManagementPlugin `json:"items"`
+}
+
 // +kubebuilder:object:generate=true
 type PluginSpec struct {
 	Version          string      `json:"version,omitempty"`
diff --git a/internal/types/generated/crossplane/v1alpha1/zz_generated.deepcopy.go b/internal/types/generated/crossplane/v1alpha1/zz_generated.deepcopy.go
index 55e0da1..08230a9 100644
--- a/internal/types/generated/crossplane/v1alpha1/zz_generated.deepcopy.go
+++ b/internal/types/generated/crossplane/v1alpha1/zz_generated.deepcopy.go
@@ -5,6 +5,38 @@
 
 package v1alpha1
 
+import ()
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AgentPermissionsRule) DeepCopyInto(out *AgentPermissionsRule) {
+	*out = *in
+	if in.ApiGroups != nil {
+		in, out := &in.ApiGroups, &out.ApiGroups
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Verbs != nil {
+		in, out := &in.Verbs, &out.Verbs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AgentPermissionsRule.
+func (in *AgentPermissionsRule) DeepCopy() *AgentPermissionsRule {
+	if in == nil {
+		return nil
+	}
+	out := new(AgentPermissionsRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *AppSetDelegate) DeepCopyInto(out *AppSetDelegate) {
 	*out = *in
@@ -71,6 +103,28 @@ func (in *ArgoCDExtensionInstallEntry) DeepCopy() *ArgoCDExtensionInstallEntry {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ArgoCDList) DeepCopyInto(out *ArgoCDList) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ArgoCD, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ArgoCDList.
+func (in *ArgoCDList) DeepCopy() *ArgoCDList {
+	if in == nil {
+		return nil
+	}
+	out := new(ArgoCDList)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ArgoCDSpec) DeepCopyInto(out *ArgoCDSpec) {
 	*out = *in
@@ -87,6 +141,22 @@ func (in *ArgoCDSpec) DeepCopy() *ArgoCDSpec {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Cluster) DeepCopyInto(out *Cluster) {
+	*out = *in
+	in.Spec.DeepCopyInto(&out.Spec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Cluster.
+func (in *Cluster) DeepCopy() *Cluster {
+	if in == nil {
+		return nil
+	}
+	out := new(Cluster)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ClusterCustomization) DeepCopyInto(out *ClusterCustomization) {
 	*out = *in
@@ -105,6 +175,11 @@ func (in *ClusterCustomization) DeepCopy() *ClusterCustomization {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ClusterData) DeepCopyInto(out *ClusterData) {
 	*out = *in
+	if in.DirectClusterSpec != nil {
+		in, out := &in.DirectClusterSpec, &out.DirectClusterSpec
+		*out = new(DirectClusterSpec)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterData.
@@ -117,6 +192,28 @@ func (in *ClusterData) DeepCopy() *ClusterData {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClusterList) DeepCopyInto(out *ClusterList) {
+	*out = *in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Cluster, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterList.
+func (in *ClusterList) DeepCopy() *ClusterList {
+	if in == nil {
+		return nil
+	}
+	out := new(ClusterList)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ClusterSpec) DeepCopyInto(out *ClusterSpec) {
 	*out = *in
@@ -134,170 +231,145 @@ func (in *ClusterSpec) DeepCopy() *ClusterSpec {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *HostAliases) DeepCopyInto(out *HostAliases) {
+func (in *Command) DeepCopyInto(out *Command) {
 	*out = *in
-	if in.Hostnames != nil {
-		in, out := &in.Hostnames, &out.Hostnames
+	if in.Command != nil {
+		in, out := &in.Command, &out.Command
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Args != nil {
+		in, out := &in.Args, &out.Args
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostAliases.
-func (in *HostAliases) DeepCopy() *HostAliases {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Command.
+func (in *Command) DeepCopy() *Command {
 	if in == nil {
 		return nil
 	}
-	out := new(HostAliases)
+	out := new(Command)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *IPAllowListEntry) DeepCopyInto(out *IPAllowListEntry) {
+func (in *ConfigManagementPlugin) DeepCopyInto(out *ConfigManagementPlugin) {
 	*out = *in
+	in.Spec.DeepCopyInto(&out.Spec)
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAllowListEntry.
-func (in *IPAllowListEntry) DeepCopy() *IPAllowListEntry {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigManagementPlugin.
+func (in *ConfigManagementPlugin) DeepCopy() *ConfigManagementPlugin {
 	if in == nil {
 		return nil
 	}
-	out := new(IPAllowListEntry)
+	out := new(ConfigManagementPlugin)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ImageUpdaterDelegate) DeepCopyInto(out *ImageUpdaterDelegate) {
+func (in *ConfigManagementPluginList) DeepCopyInto(out *ConfigManagementPluginList) {
 	*out = *in
-	if in.ManagedCluster != nil {
-		in, out := &in.ManagedCluster, &out.ManagedCluster
-		*out = new(ManagedCluster)
-		**out = **in
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ConfigManagementPlugin, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageUpdaterDelegate.
-func (in *ImageUpdaterDelegate) DeepCopy() *ImageUpdaterDelegate {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigManagementPluginList.
+func (in *ConfigManagementPluginList) DeepCopy() *ConfigManagementPluginList {
 	if in == nil {
 		return nil
 	}
-	out := new(ImageUpdaterDelegate)
+	out := new(ConfigManagementPluginList)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *InstanceSpec) DeepCopyInto(out *InstanceSpec) {
+func (in *DirectClusterSpec) DeepCopyInto(out *DirectClusterSpec) {
 	*out = *in
-	if in.IpAllowList != nil {
-		in, out := &in.IpAllowList, &out.IpAllowList
-		*out = make([]*IPAllowListEntry, len(*in))
-		for i := range *in {
-			if (*in)[i] != nil {
-				in, out := &(*in)[i], &(*out)[i]
-				*out = new(IPAllowListEntry)
-				**out = **in
-			}
-		}
-	}
-	if in.Extensions != nil {
-		in, out := &in.Extensions, &out.Extensions
-		*out = make([]*ArgoCDExtensionInstallEntry, len(*in))
-		for i := range *in {
-			if (*in)[i] != nil {
-				in, out := &(*in)[i], &(*out)[i]
-				*out = new(ArgoCDExtensionInstallEntry)
-				**out = **in
-			}
-		}
-	}
-	if in.ClusterCustomizationDefaults != nil {
-		in, out := &in.ClusterCustomizationDefaults, &out.ClusterCustomizationDefaults
-		*out = new(ClusterCustomization)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.RepoServerDelegate != nil {
-		in, out := &in.RepoServerDelegate, &out.RepoServerDelegate
-		*out = new(RepoServerDelegate)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.ImageUpdaterDelegate != nil {
-		in, out := &in.ImageUpdaterDelegate, &out.ImageUpdaterDelegate
-		*out = new(ImageUpdaterDelegate)
-		(*in).DeepCopyInto(*out)
-	}
-	if in.AppSetDelegate != nil {
-		in, out := &in.AppSetDelegate, &out.AppSetDelegate
-		*out = new(AppSetDelegate)
-		(*in).DeepCopyInto(*out)
+	if in.KargoInstanceId != nil {
+		in, out := &in.KargoInstanceId, &out.KargoInstanceId
+		*out = new(string)
+		**out = **in
 	}
-	if in.AppsetPolicy != nil {
-		in, out := &in.AppsetPolicy, &out.AppsetPolicy
-		*out = new(AppsetPolicy)
+	if in.Server != nil {
+		in, out := &in.Server, &out.Server
+		*out = new(string)
 		**out = **in
 	}
-	if in.HostAliases != nil {
-		in, out := &in.HostAliases, &out.HostAliases
-		*out = make([]*HostAliases, len(*in))
-		for i := range *in {
-			if (*in)[i] != nil {
-				in, out := &(*in)[i], &(*out)[i]
-				*out = new(HostAliases)
-				(*in).DeepCopyInto(*out)
-			}
-		}
+	if in.Token != nil {
+		in, out := &in.Token, &out.Token
+		*out = new(string)
+		**out = **in
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstanceSpec.
-func (in *InstanceSpec) DeepCopy() *InstanceSpec {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectClusterSpec.
+func (in *DirectClusterSpec) DeepCopy() *DirectClusterSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(InstanceSpec)
+	out := new(DirectClusterSpec)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManagedCluster) DeepCopyInto(out *ManagedCluster) {
+func (in *Discover) DeepCopyInto(out *Discover) {
 	*out = *in
+	if in.Find != nil {
+		in, out := &in.Find, &out.Find
+		*out = new(Find)
+		(*in).DeepCopyInto(*out)
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedCluster.
-func (in *ManagedCluster) DeepCopy() *ManagedCluster {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Discover.
+func (in *Discover) DeepCopy() *Discover {
 	if in == nil {
 		return nil
 	}
-	out := new(ManagedCluster)
+	out := new(Discover)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *RepoServerDelegate) DeepCopyInto(out *RepoServerDelegate) {
+func (in *Dynamic) DeepCopyInto(out *Dynamic) {
 	*out = *in
-	if in.ManagedCluster != nil {
-		in, out := &in.ManagedCluster, &out.ManagedCluster
-		*out = new(ManagedCluster)
-		**out = **in
+	if in.Command != nil {
+		in, out := &in.Command, &out.Command
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.Args != nil {
+		in, out := &in.Args, &out.Args
+		*out = make([]string, len(*in))
+		copy(*out, *in)
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepoServerDelegate.
-func (in *RepoServerDelegate) DeepCopy() *RepoServerDelegate {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Dynamic.
+func (in *Dynamic) DeepCopy() *Dynamic {
 	if in == nil {
 		return nil
 	}
-	out := new(RepoServerDelegate)
+	out := new(Dynamic)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Command) DeepCopyInto(out *Command) {
+func (in *Find) DeepCopyInto(out *Find) {
 	*out = *in
 	if in.Command != nil {
 		in, out := &in.Command, &out.Command
@@ -311,98 +383,166 @@ func (in *Command) DeepCopyInto(out *Command) {
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Command.
-func (in *Command) DeepCopy() *Command {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Find.
+func (in *Find) DeepCopy() *Find {
 	if in == nil {
 		return nil
 	}
-	out := new(Command)
+	out := new(Find)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ConfigManagementPlugin) DeepCopyInto(out *ConfigManagementPlugin) {
+func (in *HostAliases) DeepCopyInto(out *HostAliases) {
 	*out = *in
-	in.Spec.DeepCopyInto(&out.Spec)
+	if in.Hostnames != nil {
+		in, out := &in.Hostnames, &out.Hostnames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConfigManagementPlugin.
-func (in *ConfigManagementPlugin) DeepCopy() *ConfigManagementPlugin {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HostAliases.
+func (in *HostAliases) DeepCopy() *HostAliases {
 	if in == nil {
 		return nil
 	}
-	out := new(ConfigManagementPlugin)
+	out := new(HostAliases)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Discover) DeepCopyInto(out *Discover) {
+func (in *IPAllowListEntry) DeepCopyInto(out *IPAllowListEntry) {
 	*out = *in
-	if in.Find != nil {
-		in, out := &in.Find, &out.Find
-		*out = new(Find)
-		(*in).DeepCopyInto(*out)
-	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Discover.
-func (in *Discover) DeepCopy() *Discover {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IPAllowListEntry.
+func (in *IPAllowListEntry) DeepCopy() *IPAllowListEntry {
 	if in == nil {
 		return nil
 	}
-	out := new(Discover)
+	out := new(IPAllowListEntry)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Dynamic) DeepCopyInto(out *Dynamic) {
+func (in *ImageUpdaterDelegate) DeepCopyInto(out *ImageUpdaterDelegate) {
 	*out = *in
-	if in.Command != nil {
-		in, out := &in.Command, &out.Command
-		*out = make([]string, len(*in))
-		copy(*out, *in)
-	}
-	if in.Args != nil {
-		in, out := &in.Args, &out.Args
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.ManagedCluster != nil {
+		in, out := &in.ManagedCluster, &out.ManagedCluster
+		*out = new(ManagedCluster)
+		**out = **in
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Dynamic.
-func (in *Dynamic) DeepCopy() *Dynamic {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ImageUpdaterDelegate.
+func (in *ImageUpdaterDelegate) DeepCopy() *ImageUpdaterDelegate {
 	if in == nil {
 		return nil
 	}
-	out := new(Dynamic)
+	out := new(ImageUpdaterDelegate)
 	in.DeepCopyInto(out)
 	return out
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *Find) DeepCopyInto(out *Find) {
+func (in *InstanceSpec) DeepCopyInto(out *InstanceSpec) {
 	*out = *in
-	if in.Command != nil {
-		in, out := &in.Command, &out.Command
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.IpAllowList != nil {
+		in, out := &in.IpAllowList, &out.IpAllowList
+		*out = make([]*IPAllowListEntry, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(IPAllowListEntry)
+				**out = **in
+			}
+		}
 	}
-	if in.Args != nil {
-		in, out := &in.Args, &out.Args
-		*out = make([]string, len(*in))
-		copy(*out, *in)
+	if in.Extensions != nil {
+		in, out := &in.Extensions, &out.Extensions
+		*out = make([]*ArgoCDExtensionInstallEntry, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(ArgoCDExtensionInstallEntry)
+				**out = **in
+			}
+		}
+	}
+	if in.ClusterCustomizationDefaults != nil {
+		in, out := &in.ClusterCustomizationDefaults, &out.ClusterCustomizationDefaults
+		*out = new(ClusterCustomization)
+		**out = **in
+	}
+	if in.RepoServerDelegate != nil {
+		in, out := &in.RepoServerDelegate, &out.RepoServerDelegate
+		*out = new(RepoServerDelegate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ImageUpdaterDelegate != nil {
+		in, out := &in.ImageUpdaterDelegate, &out.ImageUpdaterDelegate
+		*out = new(ImageUpdaterDelegate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.AppSetDelegate != nil {
+		in, out := &in.AppSetDelegate, &out.AppSetDelegate
+		*out = new(AppSetDelegate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.AppsetPolicy != nil {
+		in, out := &in.AppsetPolicy, &out.AppsetPolicy
+		*out = new(AppsetPolicy)
+		**out = **in
+	}
+	if in.HostAliases != nil {
+		in, out := &in.HostAliases, &out.HostAliases
+		*out = make([]*HostAliases, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HostAliases)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.AgentPermissionsRules != nil {
+		in, out := &in.AgentPermissionsRules, &out.AgentPermissionsRules
+		*out = make([]*AgentPermissionsRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(AgentPermissionsRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
 	}
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Find.
-func (in *Find) DeepCopy() *Find {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstanceSpec.
+func (in *InstanceSpec) DeepCopy() *InstanceSpec {
 	if in == nil {
 		return nil
 	}
-	out := new(Find)
+	out := new(InstanceSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ManagedCluster) DeepCopyInto(out *ManagedCluster) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedCluster.
+func (in *ManagedCluster) DeepCopy() *ManagedCluster {
+	if in == nil {
+		return nil
+	}
+	out := new(ManagedCluster)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -499,3 +639,23 @@ func (in *PluginSpec) DeepCopy() *PluginSpec {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RepoServerDelegate) DeepCopyInto(out *RepoServerDelegate) {
+	*out = *in
+	if in.ManagedCluster != nil {
+		in, out := &in.ManagedCluster, &out.ManagedCluster
+		*out = new(ManagedCluster)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RepoServerDelegate.
+func (in *RepoServerDelegate) DeepCopy() *RepoServerDelegate {
+	if in == nil {
+		return nil
+	}
+	out := new(RepoServerDelegate)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/package/crds/core.akuity.crossplane.io_clusters.yaml b/package/crds/core.akuity.crossplane.io_clusters.yaml
index 0aabf29..922ea16 100644
--- a/package/crds/core.akuity.crossplane.io_clusters.yaml
+++ b/package/crds/core.akuity.crossplane.io_clusters.yaml
@@ -88,6 +88,17 @@ spec:
                             type: boolean
                           autoUpgradeDisabled:
                             type: boolean
+                          directClusterSpec:
+                            properties:
+                              clusterType:
+                                type: string
+                              kargoInstanceId:
+                                type: string
+                              server:
+                                type: string
+                              token:
+                                type: string
+                            type: object
                           kustomization:
                             type: string
                           redisTunneling:
diff --git a/package/crds/core.akuity.crossplane.io_instances.yaml b/package/crds/core.akuity.crossplane.io_instances.yaml
index c786f89..8318aea 100644
--- a/package/crds/core.akuity.crossplane.io_instances.yaml
+++ b/package/crds/core.akuity.crossplane.io_instances.yaml
@@ -82,6 +82,23 @@ spec:
                             type: string
                           instanceSpec:
                             properties:
+                              agentPermissionsRules:
+                                items:
+                                  properties:
+                                    apiGroups:
+                                      items:
+                                        type: string
+                                      type: array
+                                    resources:
+                                      items:
+                                        type: string
+                                      type: array
+                                    verbs:
+                                      items:
+                                        type: string
+                                      type: array
+                                  type: object
+                                type: array
                               appSetDelegate:
                                 properties:
                                   managedCluster:
@@ -515,6 +532,23 @@ spec:
                             type: string
                           instanceSpec:
                             properties:
+                              agentPermissionsRules:
+                                items:
+                                  properties:
+                                    apiGroups:
+                                      items:
+                                        type: string
+                                      type: array
+                                    resources:
+                                      items:
+                                        type: string
+                                      type: array
+                                    verbs:
+                                      items:
+                                        type: string
+                                      type: array
+                                  type: object
+                                type: array
                               appSetDelegate:
                                 properties:
                                   managedCluster: