How Keydris works

1. Issue#

You issue a signed KIT (Keydris Identity Token) to an agent. The token defines the agent's permissions and how long they last. Minimum privilege is the default: the token grants only the authority required for the task, and it expires on its own.

2. Seal#

The authorization is bound to an append-only, hash-chained log. This creates an immutable audit record of who granted what, to which agent, and when - so a grant can never be silently altered after the fact.

3. Verify#

Enforcement happens at the counterparty's front door. The receiving system verifies the token before the agent is allowed to connect or act. Authority is checked, not assumed - an agent without a valid token gets nowhere.

4. Revoke#

When authority should end, it is pulled at machine speed across every boundary. A revoked token immediately fails verification at the front door, everywhere it might be presented. You do not wait for a token to expire to cut off an agent.

What Keydris does not do#

Keydris never holds your money or your private keys. It provides cryptographic proof of authorization and the machinery to enforce and revoke it - the assets and secrets stay with you.