# Agents and safety — additions for signed items and 18+ (v0)

These rules apply to every agent that acts for a person on neverlogoff: the desk relay, a person's own AI
(BYOA), CLIs and API clients.

## 1. An agent can never confirm someone is 18 or over

- The 18+ declaration is the person's own click on our page, in their own signed-in session.
- `POST /api/age?op=declare` refuses any request that carries an agent credential **before** it reads the
  session: an `Authorization` header of any kind, `x-nlo-agent`, `x-nlo-agent-token`, `x-nlo-desk-relay`,
  or `x-api-key` → `403 agents_cannot_declare`. Holding the person's cookie does not help.
- The request must also come from our own origin (`Origin: null` and other sites are refused), carry
  `clicked: true` (the literal boolean) and name the current wording version.
- An agent that meets `age_attestation_required` stops and tells the person, in plain words, to confirm on
  neverlogoff themselves. It never retries with different headers, never automates the browser click,
  never fills the box for them.

## 2. An agent cannot get around the 18+ gates

Posting, spaces, creator money, coins and NEVERS spend, link hub pages and reach cross-posting all call
`requireAdult`. An agent acting for a person who has not declared gets the same refusal the person would.

## 3. Signing

- Agents may ask for a post's signed record (`/api/verify?item=`) and check it with `nlo-verify.js`.
- An agent must not co-sign for a person. The owner co-signature is the person's wallet signing the text
  `neverlogoff item co-sign v1` + the record hash, shown to them in their wallet.
- Deleting is the person's call; an agent may delete only when the person asked for that item to go.

## 4. Reports and moderation

- An agent may file a report for its person (`op=report`). It must not attach evidence it was not shown,
  and it must not file the same report from many accounts (independent reports are counted per person).
- Agents never read the moderation log, the moderation queue or report evidence. No route serves them.

## 5. What an agent should say

- "neverlogoff is for people 18 and over. Please confirm that yourself on neverlogoff; I can't do it for you."
- Call the person's computer "your machine" or "your computer", never slang for it.