# Agents and persons

> You own the connections and the toolbox. Each harness that connects is an agent with its own token, scope and working set.

Source: https://docs.getgraft.ai/graft/concepts/agents-and-persons

A **person** is the account holder. You own two things: your connections, entered once, and your toolbox, authored once. However many harnesses you run, a credential is typed once and a tool is written once.

An **agent** is one harness connection to Graft. It authenticates with a token of its own and holds exactly two things: a **scope**, the connections it may use, and a **working set**, the authored tools currently promoted into its list. Expansion and contraction happen per agent. Credentials and code do not.

Hermes on your laptop and OpenClaw on a server are two agents over one toolbox. They may hold the same tool in their working sets with different approval states, because approval is per agent, per tool.

## The token

An agent made in the console has a bearer token, prefixed `grft_`, shown once when the agent is created. Graft stores only its hash and prefix; the prefix is what the console shows afterwards so you can tell two agents apart. The harness carries the token as a static `Authorization: Bearer` header on every request.

An agent made by connecting [Claude or ChatGPT](https://docs.getgraft.ai/graft/harnesses/claude-and-chatgpt.md) has no static token. The product holds OAuth tokens for it, renews them itself, and the console shows the product's name beside the agent instead of a prefix. Either way one connection is one agent.

Tokens are per agent so that one leak revokes one agent. **Revoke token** (or **Revoke agent**, for one a product connected) on the agent's page stops that harness at the MCP endpoint at once: a request carrying any of its tokens is refused before any MCP handshake. The agent's row, its working set and its history stay as your records. To reconnect a harness, create a new agent; a product asks you to connect again.

## What the agent decides, and what you decide

The agent decides what is needed: which tool to look for, which connection to propose, what `acquire` should build. You enter credentials yourself, on Graft's form and never through the agent, and you answer approvals. The first real write a tool makes goes through your agent invoking the published tool, never through Graft's model.

## What is per agent

| Per agent | Per person |
| --- | --- |
| Token, or the product that holds its tokens | Account |
| Scope | Connections and their credentials |
| Working set, cap and idle window | Toolbox, every version of every tool |
| Approvals, per tool | Model key, in Settings |
| Build approvals, per connection | |

Revoking a connection therefore affects every agent at once, and every tool bound to that vendor asks again after reconnection. Revoking an agent affects nothing but that agent.

## Try it

```text
Which connections are you allowed to use right now?
```

```text
I run you on two machines. Do they share the tools you have built?
```

```text
Take everything out of your list that I have not used this month.
```