"The client's work should run on the client's account."
Each project runs on the agent account you give it. A client's API key pays for that client's work, and your own subscription stays yours.
For freelancers and studios doing client work
Every client on their own rules, their own account.
One client wants pull requests, one wants drafts only, one wants nothing done without a look first. Set it per project, and the Online shop's agents never act like the Booking app's.
"Nothing reaches a client I haven't seen."
Every pull request shows its checks, and a preview to click when your repo posts one. Status updates go only to the channel set on that project, and a secret or another client's name in one holds it for you.
"The invoice needs a story."
A work report per project, for any dates: what was done, its pull requests and the time agents spent. Send it weekly to the client's channel, with or without the cost.