Audiences and access

Grounding decides what an agent CAN say; audience policy decides who may hear it. Every leaf carries an audience, and guarded tools and actions carry their own — so one agent can hold a public FAQ and an owner-approved intake form at once.

The three levels

• Public — any visitor or caller, signed in or not. The default for published knowledge.
• Authenticated — a signed-in viewer (a vwr_ envelope). The owner grants named people access; the agent answers them from the leaves that allow it.
• Owner-approved — an explicit grant, made per person or per action. Write actions and gated content sit here.

Consent is separate from access

Three independent "yeses" and none implies another: publishing a folder makes it answer at its address; directory listing is a separate opt-in that makes it findable by strangers and other agents; and an action’s audience decides who may trigger it. An agent can be published yet unlisted, listed yet owner-approved for actions — each surface reads only the grant it was given.

The fence fails closed

When a caller’s audience does not cover a leaf, the leaf does not exist for that answer — the agent refuses or simply cannot ground from it. The same posture applies on errors: a cached check never widens access, an unknown audience value matches nothing, and a caller with no envelope gets the tightest level. See refusals and errors for what a refusal looks like on the wire.