# BuildRules auth.md

## Agent audience

This document is for AI assistants and automated clients accessing BuildRules at https://buildrules.ca.

## Supported access methods

### Anonymous public reading

Published public pages can be read over HTTPS without registration, an account, an API key, or a bearer token. No credentials are issued for this access method.

Start at https://buildrules.ca/locations for municipal coverage or https://buildrules.ca/projects to compare one project across cities. Discover published pages using https://buildrules.ca/sitemap.xml and respect https://buildrules.ca/robots.txt.

### Agent registration and provisioning

BuildRules does not currently support agent account registration, agent credential provisioning, or delegated OAuth access. There is no supported agent registration or provisioning endpoint. Do not call POST /agent/auth or infer a registration endpoint from the administrator login.

ID-JAG, verified-email agent registration, anonymous credential issuance, and agent token revocation are not supported.

## Credential use

For public reading, omit the Authorization header. BuildRules does not accept agent bearer tokens or API keys.

The administrator login at https://buildrules.ca/admin/login is for manually provisioned human CMS administrators. It is not an agent registration method and does not grant public clients permission to write CMS content.

## Actions with side effects

POST https://buildrules.ca/api/leads submits a project enquiry, not an authentication or registration request. It requires the person's consent. Do not invoke it during discovery or passive scanning.

## OAuth discovery

BuildRules does not currently publish an OAuth authorization server or an agent-facing OAuth protected resource. No issuer, scopes, token endpoint, or registration method is advertised by this document.

## Source guidance

Public content provides guidance from published sources. Preserve source links and verification dates when presenting answers.