--profile scopes the grant to one bot.
They see only granted nodes. Paths are hidden from members. An ungranted /node payroll reads as “no such node” — telekit does not confirm that the node exists.
Thread grants: omit for default, or list slugs, or * for all.
/whoami prints the numeric id to give the owner.