Features / Approval to open
Above your level, other people say yes, on their own phones.
Opening a file above your clearance sends a request to officers. Each one checks it on their own phone and signs it there. The PC opens exactly that file, for that person, and nothing more.
officers needed, rising with the level
signatures made on the officer's own device, where the key stays
a grant opens one exact file, identified by its SHA-256 hash
How it works
Request, sign, open
Request
The request names the file's hash, its level and the person asking. It reaches the officers end-to-end encrypted in ZENOS Messages.
- A match code is shown on the requester's screen
- It is never sent; the officer reads it there
Sign
The officer's device rebuilds the request from what it shows and signs that. An approval cannot be read as a decline, or the other way round.
- A decline renews the request
- An old or unknown key is refused
Open
The key agent checks every signature against keys the administrator enrolled, then opens that one file.
- The requester's own approval never counts
- No officer counts twice
Proven, and what is not
Who counts is mathematics
Checked on every build
- Opening above clearance needs at least one enrolled officer other than the user, whose signature verified
- The requester's own approval never counts, and no officer counts twice
- A signature that counts was made for exactly that request
- An approval can never be read as a decline, or the reverse
Tested and listed openly
- Ed25519 signatures cannot be forged, and SHA-256 has no collisions
- The officer's key is kept by the browser, not yet on a FIDO2 key
- An officer who loses the device must be enrolled again
Try it in the preview
Try it yourself
Enroll two officers
Each makes an approval key in ZENOS Messages; the administrator enrolls it.
Open a Red · L4 file
From an account cleared below L4. The request reaches both phones.
Read the code, approve
Each officer matches the code on the screen and approves. The file opens.