> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fau.run/agent-docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Concepts

> Nodes, relays, domains, grants, and why the relay is blind.

## Roles

```
Your agent ──HTTPS──▶ relay.fau.run (/v1/resolve)
Your agent ──TLS──▶ <label>.relay.fau.run:443  ──(blind pipe)──▶ user's Mac node
                                                              └── POST /mcp (MCP tools)
```

| Role          | What it is                                                                                                         |
| ------------- | ------------------------------------------------------------------------------------------------------------------ |
| **User node** | On the user’s Mac. Holds Gmail credentials, encrypted store, grants, audit log. Terminates TLS for its hostname.   |
| **Relay**     | Blind rendezvous. Peeks SNI, forwards ciphertext. Discovers nodes by HMAC of email. No mail, no node private keys. |
| **Agent**     | You. Identified only by a domain that publishes Ed25519 keys.                                                      |

## Identity is a domain

You are `assistant.example`, not an API key. The node fetches
`https://assistant.example/.well-known/fau-agent` and verifies RFC 9421 signatures.
Prompts show that verified domain.

## Open addressing, closed permission

Anyone can resolve an email and attempt a signed call (like sending email). Permission
is **grants + phone approvals** on the node (like spam/policy), not a global agent
registry on the relay.

## Grants and tiers

| Tier              | Typical tools                                      | Phone?                 |
| ----------------- | -------------------------------------------------- | ---------------------- |
| `structured_read` | `get_upcoming_travel`, `order_status`, `bills_due` | Often auto after grant |
| `free_form_read`  | `ask`                                              | Often auto after grant |
| `raw_read`        | `get_excerpt`                                      | **Always**             |
| `compose`         | `create_draft`, `draft_reply`                      | Often auto after grant |
| `send`            | `send_draft`                                       | **Always**             |

Categories that may appear in grants: `travel`, `orders`, `bills`, `finance`,
`personal`, `work`. (`security_codes` is never granted.)

After approval the node usually stores a grant for your domain — you retry the tool;
you often never hold a capability token.

## Blind relay

The relay sees metadata (HMAC of email, hostname, timing, bytes). It cannot read tool
arguments or answers. Unknown emails get **decoy** hostnames with the same JSON shape.

## Offline users

If the Mac is asleep, sealed requests can wait on the queue (24 h). Prefer live TLS when
`/.well-known/fau-node` answers.