7. Who may pull a plug
Every well-signed revocation is accepted. Its effect is scoped to where its signer stands: their own hop, their own signatures, or any route through a node they hold admin over. The set of nodes you hold admin over, plus your own node, is your admin reach.

7. Who may pull a plug

Every well-signed revocation is accepted. Its effect is scoped to where its signer stands: their own hop, their own signatures, or any route through a node they hold admin over. The set of nodes you hold admin over, plus your own node, is your admin reach.

Admin is not a rank. It is a set of rooms, and knowing which rooms tells you exactly which cords you can pull, and which you cannot.

Any well-signed revocation goes into the bag. The question is never whether it is valid. The question is what it covers.

First: your own strip. Carol invited Eve. Carol can unplug Eve from her own strip. That cuts routes through Carol, and nothing else.

Second: your own signatures. If you signed a certificate, as giver or receiver, you can kill it on every route. When your key leaks, you can cut everything that names it. No one to ask.

Third: admin. Admin over a node is a key to that room. You can unplug any cord that runs through your room, however far downstream.

Your rooms, plus your own strip, are your reach. Admin in Owners, and Owners is admin over Members? Then you have a key to Members too.

What you cannot do: cut the cord you stand on. The supply that feeds Members runs through rooms above you. Your revocation of it does nothing.

A revocation that touches none of your rooms, and none of your signatures, is a no-op. Not an error. Just inert.

Admin is not a rank. It is a set of rooms. Your revocation power is exactly the cords that run through them.

Check yourself. Bob is an admin of Members. Can he revoke Dan's supply of the document into Members?

Do you like what you are reading? Subscribe to receive updates.

Unsubscribe anytime

Comments