How Keydris works

Keydris runs one tight loop around every agent action: Issue → Seal → Verify → Revoke. Understand these four steps and you understand the whole system.

The KIT (Keydris Identity Token)#

The KIT is a signed token issued to an agent. It declares what the agent may do and for how long, with minimum privilege as the default - an agent gets exactly the authority it needs for the task in front of it, and nothing more.

1. Issue#

You issue a signed KIT to an agent. The token defines its permissions and their lifetime. Because minimum privilege is the default, a token grants only the authority the current task requires, and it expires on its own.

2. Seal#

The authorization is bound to an append-only, hash-chained log. This creates an immutable record of who granted what, to which agent, and when - so a grant can never be silently altered after the fact.

3. Verify#

Enforcement happens at the counterparty's front door. The receiving system verifies the token before the agent is allowed to connect or act. An agent without a valid token gets nowhere.

4. Revoke#

When authority should end, it is pulled at machine speed across every boundary. A revoked token immediately fails verification everywhere it might be presented. You do not wait for expiry to contain a misbehaving agent.

What Keydris does not do#

Keydris never holds your money or your private keys. It provides cryptographic proof of authorization and the machinery to enforce and revoke it - your assets and secrets stay with you.

Next: issue your first token.