I don't think it would be difficult to write a terraform template that SSH's in as root, creates a user for each workspace and starts the agent as that user