It needs to run once the agent is up and active.

The ./ needs to run by the root user on *NIX.

Restart the agent from the Skybot Scheduler or updated an agent from the Scheduler and the blessing of the ./ is still in effect. 

If the agent is stopped or the agent has crashed the ./ needs to be run again.

On *NIX this can be run from the init.d but make sure there is a delay so that the agent is up and active.

Error you will see in the agent log:
on host "xxxxxx" does not key an authorized agent execution - authorization failed