A certificate's subject is a scope. About a document, it helps you reach that document and nothing else. About a role, it is membership, and it carries whatever the role reaches, now and later.

This is how fifty documents and ten people stay sixty certificates instead of five hundred, and why adding a document re-issues nothing.

Ten people. Fifty documents. One certificate per person per document is five hundred. Every new hire is fifty more.

Keyline has no group object. A role is just another key. Mint it, have it sign Dan in as admin, and throw the private key away.

Two kinds of certificate hang off a role. A supply: Dan gives Members edit over the document. A membership: Dan puts Alice in Members.

Alice's power over the document is the smaller of two things. What Members has over the document. And what Alice has in Members.

A certificate about the document helps you reach that document. Nothing else. A certificate about Members is a membership. It carries everything Members reaches. Now, or in the future.

New document? One supply. Every member has it at once. Nobody re-issues anything.

Someone leaves? Take back one membership. They are out of all fifty.

A membership is a promise about the future. Whatever Members is wired into later, every member reaches it. Each at their own level.

Check yourself. Members is supplied into a new document tomorrow. What has to be re-issued for Alice to use it?