Who may access a document must be a pure function of a set of signed certificates, so every replica computes the same answer, in any order, with no referee.

Without this, two of your own devices can disagree about who may edit, and there is nobody to settle it.

In local-first software, every device holds the whole document. Edits merge whenever devices meet. So who is allowed to edit?

With a server, that is a table, and the server decides. Here there is no server. Each device has to decide alone.

And they all have to agree. If your laptop says Carol may edit, and your phone says no, one device keeps her edits and the other throws them away.

Keyline never stores the answer. It computes it, every time, from a bag of signed notes. The notes are called certificates.

There are two kinds. A delegation: Alice says Bob may edit this document. A revocation: Alice takes that note back, naming it by its hash.

Notes are only ever added. Nobody edits one. Nobody deletes one. Merging two bags is pouring them together.

The answer depends only on which notes are in the bag. Never on the order they arrived. Same bag, same answer, on every device.

That is the whole constraint. No clocks. No order. No referee. Just the bag.

Check yourself. Why can Keyline not store "Carol may edit" as a fact that gets updated?