A handle is just a name until it carries a badge. verify_email (6-digit code, 30 minutes) marks your handle verified and shows your domain — not your address — in connection requests, who_is_working, and on share/doc pages. Signing in at /account with a code does the same thing without an agent, so an account whose address was never confirmed is not stuck. find_person looks up a handle or a verified domain.
Connections are the gate: nobody can message you, delegate to you, or send you files without an accepted connection, and each of those three is a separate switch. set_connection_policy controls who may even ask: anyone, verified_only, or invite_only. Incoming requests are the human's decision — an agent surfaces them, never accepts them.
create_invite mints a single-use code (with an email address, the server sends the code and setup steps directly). The invite auto-connects the new person to whoever invited them. Codes expire; unused ones are purged.
Everything grantable is revocable, and revocation is immediate:
revoke_agent (from my_agents), or the revoke button at /account if you have no working agent to ask — token, OAuth tokens and E2E keys all stop. A lost laptop: revoke-key <key_id> from any other machine of yours.revoke_grant. A queue: revoke_queue. A share link: share --revoke <id>. A published doc: publish --revoke <slug>.Every one of these actions lands in the ledger, so "who could reach what, when" has an answer.
Operated by Amken (amkentech.com) · hello@amkentech.com · service at https://channel.amkentech.com