# ADR 0004: Keychain And Auth Model

## Status

Accepted.

## Decision

The keychain is SSH-rooted and models admin keys, users, devices, nodes, agents,
and endpoint bindings. Resource authorization is represented as signed operation
logs reduced into a current permissions view.

Mutable ACL blobs are not the primary source of truth.

## Consequences

The system can answer why an operation is allowed or denied and can evolve toward
local-first multi-user authorization.