# Connecting an agent

**One connection per agent.** Not access to a mailbox and not access to a CRM —
which is a different ask of a different person, and the reason
`design/00-north-star.md`'s eighth bet was rewritten.

## What you need

| | |
|---|---|
| the endpoint | your deployment's `/mcp`. Through the platform's one hostname that is `https://app.reynforce.com/t/<your-tenant>/mcp` |
| a key | issued by us today. `Create agent keys from the screen` is on the build map and is not built |
| nothing else | no OAuth dance for an agent. A key is a bearer token, and the tool list you are shown depends on it |

## What an agent is entitled to

**An agent reads the register and asks permission. It cannot add a claim.**

| scope | what it is for |
|---|---|
| `register:read` | read what the company stands behind |
| `check` | ask whether an action is permitted, which records the asking |

`register:write` exists and **an agent key cannot hold it.** Accepting a claim,
assigning an owner, confirming one or contesting one are a person's acts, and
the reason is the product rather than caution: a register an agent can write is
a register that says whatever the agent already believed.

## The three things that go wrong at the door

**All three are answered before any tool exists to the caller**, so a refusal is
a `401` and an empty tool list rather than a tool that fails.

| what you see | what it means | what to do |
|---|---|---|
| `401` with `{"error": "invalid_token"}` and a sentence about where to ask | no credential arrived, or one we do not recognise | ask the company running the deployment for a key. The body carries the address when that deployment has been given one |
| `401` and an **empty tool list** | the credential belongs to a different customer | you are pointed at the wrong deployment. The tenant in the path and the tenant in the key must be the same |
| the tool list is shorter than you expected | your credential holds fewer scopes | an agent key never shows the writing tools. That is not a misconfiguration |

**A key issued to one customer cannot read another's register**, and that is
checked at the authorisation edge rather than inside a tool — so it holds for
every tool, including ones added after the check was written.

## What happens when you call `check_action`

You send an action. You get a decision. **The record is a side effect of the
check and is not something you send** — there is no tool that files a
commitment, so you can be wrong about your own action and still cannot be wrong
about the record.

**There is deliberately no way to ask without recording.** An agent that could
ask *would this be allowed* with no trace could ask until the answer was yes.
`intent="draft"` and `happened=false` are the honest versions: the check is
recorded and the touch is not, because nothing was touched.