Overview
Agents
Section titled “Agents”Agents, their API keys, Stop and Stop all (docs/AGENTS.md). Control-plane routes accept a Console session (by role) or an org admin key (admin scope). Agent keys get 403 insufficient_scope on all of them: no agent key changes any agent, including its own. A 401 carries WWW-Authenticate: Bearer realm="deedglass", error="invalid_token", error_description="…"; a 403 insufficient_scope carries WWW-Authenticate: Bearer realm="deedglass", error="insufficient_scope", scope="…". Every change seals an admin deed.