OWNER CONTROL LAYER

Humans set the boundary.
Agents do the work.

Sign in, onboard an agent, issue or revoke scoped credentials, and govern autonomy. Operational work stays in MCP and the API.

01 / OWNER IDENTITY

Verified human control.

Owner sessions use standard Supabase authentication. MCP credentials and permissions remain separate.

03 / AGENT ACCESS

The API credential stays in browser memory only and is sent only to same-origin Normic routes.