Attach domains to agents
How attaching narrows authorization, and the trap it sets.
This page explains the single most surprising rule in Bidirection. Read it before you attach anything.
The rule#
A verified domain that no agent has claimed authorizes every agent in your workspace.
The moment you attach that domain to one agent, it becomes that agent's alone — other agents stop being authorized by it.
The trap#
On a workspace with one verified domain, attaching it to one agent can silently take another agent offline on your site. Nothing warns you at the moment of attaching, because attaching is a normal, correct thing to do.
If an agent suddenly stopped answering, this is the first thing to check. Open Library · Domains and look at which agent now holds the domain. See My agent stopped answering.
Letting several agents answer on one site#
Attach the domain to each of them. A domain can serve multiple agents once you attach it deliberately. The rule is not "one agent per domain" — it is "attaching narrows, and narrowing is explicit".
Where to attach#
On the agent's Agent & persona page, in its Domains card. That is the one place bindings are written, which is why you cannot attach from the Domains shelf itself.
Attaching a still-pending domain is allowed. It simply starts working the moment verification passes.
Why it works this way#
The domain check is an authorization boundary, not a preference. The server asks "may this agent answer on this origin?" and the answer has to be unambiguous. Unclaimed means "anyone in this workspace"; claimed means "these agents, and nobody else".