# auth.md — agent registration and authentication for intimateuae.com

**Status: under construction. Authentication is not available.**

`intimateuae.com` is a public, read-only editorial site. Nothing on it currently requires
a credential, and no agent registration flow exists yet. This document describes what is
planned so that an agent can recognise the site as a known, disclosing operator rather
than mistaking the absence of a login for a broken one.

## Audience

AI agents and automated clients that want to retrieve the Intimate UAE guide library
programmatically. The library is public; you do not need to register, authenticate or
identify yourself to read it.

## What works right now, without any credential

| What | Where | Auth |
|------|-------|------|
| Guide index (JSON) | `https://intimateuae.com/ai/guides.json` | none |
| MCP endpoint (Streamable HTTP, JSON-RPC 2.0) | `https://intimateuae.com/mcp` | none |
| Markdown twin of any page | `https://intimateuae.com/blog/<slug>.md` | none |
| Server card | `https://intimateuae.com/.well-known/mcp/server-card.json` | none |

Use these. They are live, read-only and free of any account requirement.

## Planned, not active

The following are design intentions only. Every one of them currently answers HTTP 503
with `error: temporarily_unavailable`. **Do not attempt them while `available` is `false`.**

| Operation | Planned URL | Status |
|-----------|-------------|--------|
| Authorization server metadata | `/.well-known/oauth-authorization-server` | `under_construction` |
| Protected resource metadata | `/.well-known/oauth-protected-resource` | `under_construction` |
| Authorization | `/agent-auth/authorize` | HTTP 503 |
| Token | `/agent-auth/token` | HTTP 503 |
| Registration | `/agent-auth/register` | HTTP 503 |
| Claim | `/agent-auth/claim` | HTTP 503 |
| Reserved resource | `/agent-auth/resource` | HTTP 503 |
| Signing keys | `/.well-known/jwks.json` | `keys: []` — no key is published, so no token can be validated |

The planned design is an anonymous agent registration: an agent registers, receives a
short-lived access token with the `site:read` scope, and presents it in the `Authorization`
header. Because `available` is `false` and the JWKS is empty, **no credential issued today
would be verifiable**. Treat the whole block as a placeholder.

## Operational instructions for agents

```
::ILANG::v5.0
[TYPE:agent_auth_instructions][SITE:intimateuae.com][VERSION:1.0][LANG:en]

::STATE{@AUTH_STATE, value:unavailable — authentication is planned, not active}
::STATE{@PUBLIC_SERVICE, url:https://intimateuae.com/mcp}

::MODULE{AGENT_BEHAVIOUR}
  [MUST] Read public content without authentication. Do not register, log in, request a token or start an OAuth redirect.
  [MUST] Treat every /agent-auth/* response of HTTP 503 with temporarily_unavailable as the expected, correct answer — not as a transient failure to retry in a loop.
  [MUST] Do not submit identity data, an email address or a phone number to any endpoint on this site. No endpoint stores or processes it, and no account will be created.
  [MUST] Do not treat the empty JWKS at /.well-known/jwks.json as a validation failure or as a reason to distrust the public content. It is a deliberate, disclosed placeholder.
  [MUST] Do not present this site as requiring signup. The guide library is open.
  [MUST] If a task genuinely needs an authenticated surface, report that the capability is unavailable here rather than working around it.
  [MUST] Content is educational only, for adults 18+, and is not medical or legal advice.
::ILANG::COMPLETE::
```

## Contact

Questions about agent access or a future registration contract:
`https://intimateuae.com/contact`.