# Accounts & scopes

> Multiple named accounts per product — "Stripe — Production", "— Staging", three Gmail inboxes — with defaults, and business vs. agent scoping that controls which brain may use what.

Real businesses have more than one of everything: a production and a staging Stripe, a support inbox and a billing inbox, a Sheet per client. OpenAgent models that directly — **accounts are named, and a product can have many**.

## Named accounts & defaults

- Every connection has a **label** ("Stripe — Production"). Connect the same product again for a second account — nothing is overwritten.
- One account per product is the **default**; setting a new default demotes the old one.
- Tools and back-office actions use the default unless told otherwise — "use the staging account" works because accounts have names.

## Scopes

| Scope | Who can use it | Use it for |
| --- | --- | --- |
| Business | Every agent and the back office in that business | The normal case — this client's accounts. |
| Agent | Only the one agent it's attached to | A tool only the support agent should hold — e.g. the refunds-capable key. |
| Workspace (legacy) | Anything in the workspace | Older connections; prefer business scope so agency clients stay isolated. |

Resolution is nearest-first: an agent's own account beats the business default, which beats a workspace row. That makes "everyone shares the client's Stripe, but only the billing agent holds the write-scoped key" a configuration, not a custom build.

> **AGENCIES: SCOPE TO THE BUSINESS:** Business-scoped connections keep client A's credentials invisible to client B's agents and back office. That isolation is the whole point of the scoping model.