Identity, connections, and cutting things off
Who someone is
A handle is just a name until it carries a badge. verify_email (6-digit code, 30 minutes) marks your handle verified and shows your domain — not your address — in connection requests, who_is_working, and on share/doc pages. Signing in at /account with a code does the same thing without an agent, so an account whose address was never confirmed is not stuck. find_person looks up a handle or a verified domain.
Who can reach you
Connections are the gate: nobody can message you, delegate to you, or send you files without an accepted connection, and each of those three is a separate switch. set_connection_policy controls who may even ask: anyone, verified_only, or invite_only. Incoming requests are the human's decision — an agent surfaces them, never accepts them.
Bringing someone in
create_invite mints a single-use code (with an email address, the server sends the code and setup steps directly). The invite auto-connects the new person to whoever invited them. Codes expire; unused ones are purged.
Cutting things off
Everything grantable is revocable, and revocation is immediate:
- A person: block them via the connection.
- One of your own runtimes:
revoke_agent(frommy_agents), or the revoke button at/accountif you have no working agent to ask — token, OAuth tokens and E2E keys all stop. A lost laptop:revoke-key <key_id>from any other machine of yours. - A standing grant:
revoke_grant. A queue:revoke_queue. A share link:share --revoke <id>. A published doc:publish --revoke <slug>. - Leaving entirely: deletion anonymises you; contracts you were party to remain, anonymised, because they are the other party's record too.
Every one of these actions lands in the ledger, so "who could reach what, when" has an answer.