diff --git a/src/broker-nats.ts b/src/broker-nats.ts
index a938076..6fc48a0 100644
--- a/src/broker-nats.ts
+++ b/src/broker-nats.ts
@@ -85,6 +85,10 @@ export async function connectNats(
     pass: cred.password,
     name: `${cred.node ?? "?"}.${self}`,
     tls: cred.fingerprint ? await pinnedTls(cred.url, cred.fingerprint) : undefined,
+    // Its own inbox, not a random one: every user's inbox is private to it (design 25 §4), and the
+    // grant names `_INBOX.<user>.>` — a reply space the client invented would be refused, and with
+    // it every pull for the next message and every answer to a tool call.
+    inboxPrefix: cred.user ? `_INBOX.${cred.user}` : undefined,
     // Reconnect forever: the bus being restarted is an upgrade, not a reason for every module on
     // the mesh to exit. `close()` stays the only thing that ends the connection.
     maxReconnectAttempts: -1,