# Audiences and access

> Who may hear an answer: the three audience levels, per-leaf and per-action policy, and why the fence fails closed.

HTML version: https://agentbag.ai/docs/audiences-and-access — updated 2026-10-12.

Grounding decides what an agent CAN say; audience policy decides who may hear it. Every leaf carries an audience, and guarded tools and actions carry their own — so one agent can hold a public FAQ and an owner-approved intake form at once.

## The three levels

- Public — any visitor or caller, signed in or not. The default for published knowledge.
- Authenticated — a signed-in viewer (a `vwr_` envelope). The owner grants named people access; the agent answers them from the leaves that allow it.
- Owner-approved — an explicit grant, made per person or per action. Write actions and gated content sit here.

## Consent is separate from access

Three independent "yeses" and none implies another: publishing a folder makes it answer at its address; directory listing is a separate opt-in that makes it findable by strangers and other agents; and an action’s audience decides who may trigger it. An agent can be published yet unlisted, listed yet owner-approved for actions — each surface reads only the grant it was given.

## The fence fails closed

When a caller’s audience does not cover a leaf, the leaf does not exist for that answer — the agent refuses or simply cannot ground from it. The same posture applies on errors: a cached check never widens access, an unknown audience value matches nothing, and a caller with no envelope gets the tightest level. See [refusals and errors](/docs/refusals-and-errors) for what a refusal looks like on the wire.

> Owners on plans that arm it get an access matrix in the workspace — a reach grid that separates "this leaf is addressable" from "this caller is actually allowed" and refuses to report one as the other.