# Consent, scopes and exact-operation approval

Read what an application can access and keep that access separate from permission to move value.

Canonical: https://docs.bankeiz.com/permissions/
Reviewed: 2026-10-25; coordinated packages 129.0.0; ruleset 127.0.0.

## Access and execution are separate

An application registration identifies an integration. A user grant authorizes its named scope. A financial action still requires its own source-bound review and explicit approval of the exact operation. A public client ID, connected account, successful sign-in or model instruction cannot stand in for that final authority.

**Keep every boundary explicit**

1. Registration: Exact application coordinate.
2. Grant: Listed access under the identity.
3. Review: Actual participant, source and units.
4. Execution: Only the approved supported operation.

## Current Bank access families

**Read the displayed consent, not a generic permission label**

| Family | Existing purpose | Separate boundary |
| --- | --- | --- |
| Account reads | receiz:wallet.read, settlement.read and reserve.read. | No transfer, purchase or sale authority. |
| Wallet Send | Wallet read and transfer access for the payment explicitly approved. | Each payment has separate final approval. |
| Market reads/trades | Read quote/position/original results; submit the manual trade approved. | Execution uses current Market rules and price. |
| Messaging | Read/send conversations, groups, calls and owner Twin execution. | No payment or automatic reply authorization; camera/microphone have device permission. |
| Native operations | Listed source, subject, domain, Reserve/Settlement and record/seal scopes. | Each custody/ownership/financial operation retains its own contract. |
| Recovery | Read the original retained transaction result. | No new execution. |

## Review a request for bank access

1. **Open the connection detail** — Inspect Account authorization required and Permission details where shown.
2. **Read bank access** — Review the actual listed consent and intended identity.
3. **Approve deliberately** — Use I allow the listed Bankeiz access for this ID and Approve bank access only if it matches the intended operation.
4. **Keep financial review separate** — Connection readiness does not execute a transfer or qualify every host capability.

## Private account proof is a distinct disclosure

Connect account proof supplies the complete private source for the named bank connection under its separate approval. It is not the public Share an account proof operation. A public proof requires its own exact disclosure review. Enabling future updates adds another explicit scope of publication; stopping updates does not recall copies already shared.

- [Private and public disclosure](https://docs.bankeiz.com/disclosure/)

## Compose integrations without widening authority

Use the actual installed operation’s scope, source and runtime requirements. Preserve the registered application coordinate byte-for-byte, including its rc_ prefix and case. Do not fabricate grants, booleans, session handles or signatures. If access is unavailable, state which grant or host capability is missing. An agent with continuity still needs the permission and tools of each compatible environment; it does not inherit universal access.

- [Integration responsibilities](https://docs.bankeiz.com/integrations/)
- [Agent continuity and tools](https://docs.bankeiz.com/agent-continuity/)

## Implementation sources

- [Exact Bank scopes and consent text](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/src/receiz/config.ts)
- [Permission review and approval controls](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/src/features/account/BankConnection.tsx)
- [Registered native access and session boundaries](https://github.com/kojibai/reality-grade-banking/blob/6c5d582/src/receiz/bank-native-session.ts)

## Related documentation

- [Identity and account access](https://docs.bankeiz.com/identity/)
- [Your agent, identity and connected context](https://docs.bankeiz.com/agents/)
- [Build an implementation of the standard](https://docs.bankeiz.com/integrations/)
- [Share proof without sharing private authority](https://docs.bankeiz.com/disclosure/)