Secrets infrastructureAccess control
Recipients and sharing
Register recipients, share an item, revoke a recipient, and re-encrypt access cleanly.
Recipients and sharing — contract and behavior
- A registered recipient contributes a public key; Skarbiec does not need their private key to share data.
- Sharing re-encrypts the item so the new recipient can decrypt the same canonical record.
- Revocation removes the recipient and re-encrypts to the remaining group; it cannot erase plaintext a former recipient already copied.
- Owner and recovery access remain explicit in the recipient group throughout normal sharing changes.