# Frailen > Frailen is agent infrastructure for software companies. The company connects its API once, and agents operate its product on behalf of its users (the first one is a support agent inside the product). Every agent runs on the same runtime, which acts with the user's own permissions, confirms anything with damage (money, bulk changes, notices to third parties, anything that can't be undone), reads every write back from the API to check it held, and records everything in a log that only grows. For a coding agent integrating Frailen into a company's product: - The agent never goes into the company's database: everything goes through its API, with the person's permissions. - Frailen holds no key it could use to sign on anyone's behalf. The company's backend signs the session (ES256, with its JWKS) and exposes `POST /frailen/token` (RFC 8693), which exchanges it for an API token for that person, valid for 300 seconds or less. - The agent's tools are YAML tool cards, one per API operation: method, route, parameters (JSON Schema), pattern, damage, how it is read back and how it is undone. They are built from the OpenAPI and approved by a person at the company. The card format's keys are in Spanish (`metodo`, `ruta`, `dano`, `relee_con`…). - The chat runs in an iframe served by Frailen. The company's page mounts it with `frailen.js`, a `