<p>
    When checked, this credential may be used freely in Pipeline steps such as <code>withCredentials</code> and <code>withGit</code>.
    An unrestricted access token will be sent to the agent and available for use from user-defined scripts.
    These might be used to make REST API calls, push tags to the Git server, and so on.
    It may also be used in <code>git</code> steps, or <code>checkout</code> with an arbitrary argument, to clone repositories.
</p>
<p>
    Be very careful about using this option.
    The token will be able to access any repositories on which the app is installed,
    and be granted all of its permissions.
    If some users of the controller who can define jobs or edit build scripts are not fully trusted,
    it is advisable to define a separate app installed on specific repositories and with minimal permissions,
    then create a separate credential object on a folder dedicated to this purpose.
</p>
<p>
    When unchecked (the default), the credential is <em>restricted</em>.
    It may be used freely by REST API calls inside the controller, such as for branch indexing;
    or by Git operations inside the controller, such as library checkouts.
    It may also be passed to an agent for use in <code>checkout scm</code>,
    but the resulting token will be limited to the one repository
    and granted only permission to read repository contents:
    the minimum necessary for that <code>git clone</code> to work.
</p>