Connecting an agent
Last updated
One connection per agent. Not access to a mailbox and not access to a CRM — which is a different ask of a different person, and the reason design/00-north-star.md's eighth bet was rewritten.
What you need
| the endpoint | your deployment's /mcp. Through the platform's one hostname that is https://app.reynforce.com/t/<your-tenant>/mcp |
| a key | issued by us today. Create agent keys from the screen is on the build map and is not built |
| nothing else | no OAuth dance for an agent. A key is a bearer token, and the tool list you are shown depends on it |
What an agent is entitled to
An agent reads the register and asks permission. It cannot add a claim.
| scope | what it is for |
register:read | read what the company stands behind |
check | ask whether an action is permitted, which records the asking |
register:write exists and an agent key cannot hold it. Accepting a claim, assigning an owner, confirming one or contesting one are a person's acts, and the reason is the product rather than caution: a register an agent can write is a register that says whatever the agent already believed.
The three things that go wrong at the door
All three are answered before any tool exists to the caller, so a refusal is a 401 and an empty tool list rather than a tool that fails.
| what you see | what it means | what to do |
401 with {"error": "invalid_token"} and a sentence about where to ask | no credential arrived, or one we do not recognise | ask the company running the deployment for a key. The body carries the address when that deployment has been given one |
401 and an empty tool list | the credential belongs to a different customer | you are pointed at the wrong deployment. The tenant in the path and the tenant in the key must be the same |
| the tool list is shorter than you expected | your credential holds fewer scopes | an agent key never shows the writing tools. That is not a misconfiguration |
A key issued to one customer cannot read another's register, and that is checked at the authorisation edge rather than inside a tool — so it holds for every tool, including ones added after the check was written.
What happens when you call check_action
You send an action. You get a decision. The record is a side effect of the check and is not something you send — there is no tool that files a commitment, so you can be wrong about your own action and still cannot be wrong about the record.
There is deliberately no way to ask without recording. An agent that could ask would this be allowed with no trace could ask until the answer was yes. intent="draft" and happened=false are the honest versions: the check is recorded and the touch is not, because nothing was touched.