Permissions
Each connection holds a set of scopes. Your AI client asks for them when it connects, the Farao app shows you the request, and you approve or decline it. A tool only works if the connection holds its scope. Otherwise it returns missing_scope.
Scopes
| Scope | Unlocks |
|---|---|
account:read | The linked account, the execution mode, the granted scopes and your trading limits |
portfolio:read | Balances, free cash and total wealth |
positions:read | Open positions |
orders:read | Resting orders and recent fills |
markets:read | Prices, candles, indicators and all Farao intelligence |
orders:create | Preparing and executing new orders |
positions:close | Closing positions |
orders:cancel | Cancelling resting orders |
tpsl:write | Setting and removing take profit and stop loss |
social:post | Posting a thesis to your public Farao feed |
Scopes match exactly. orders:create does not include orders:cancel, and no scope implies another.
Each tool page lists the scope it needs. An agent can read the scopes it was granted with get_account_status.
What a connection can never do
No scope exists for these, so no client can be granted them:
- Withdraw or transfer funds.
- Change your account settings.
- Use cross margin. Every position is opened with isolated margin, so a loss is capped at that position's margin.
- Raise its own limits or add scopes. A change to permissions needs a new approval from you in the Farao app.
How long a connection lasts
You choose the expiry when you approve: 7 days, 30 days or no expiry. After it expires the client has to connect again.
Revoke
Open the Farao app and go to Settings → Connected apps, then revoke the connection. Orus checks that the connection is still live on every tool call, so a revoked one fails on its next call with grant_revoked.
Change permissions
Scopes are fixed when you approve. To give a client more or less access, reconnect it from your AI client and approve the new request in the Farao app.