Security boundaries
c6s separates four events that ordinary onboarding can make look like one:
- Account authentication proves a Google or Apple identity to the hosted service.
- Device enrollment decides whether a local device receives trusted capability.
- Vault unlock makes protected local key material usable after local policy.
- Operation approval signs one immutable target, input set, scope, and expiry.
Passing one boundary never implies that the next boundary passed.
Web boundary
The public site and Console do not decrypt, reveal, copy, or execute with vault secrets. Console is limited to non-secret account, device, and request-coordination state accepted by the current API contract.
Personal and Team Organizations
Every account has its own Personal Organization. Team Organizations add a separate coordination space for membership metadata; joining or selecting a Team does not change the account's Personal vault.
In the private beta, Organizations in Console lets you list your organizations, create a named Team, and inspect its members. Owners and administrators can invite members or administrators and resend or revoke pending invitations. An invitation opens a preview of the Team name and role and requires explicit acceptance while signed in.
Selecting an organization changes the coordination view on that page. It does not switch the whole Console: the Dashboard remains scoped to your Personal Organization. Owners can review and confirm member-role changes or removals; administrators can remove other non-owner members. Each confirmation rechecks the signed-in account, selected Team, and current membership. The Team must retain an active owner. If a result cannot be confirmed, reload and review the current membership before trying again. Switching a saved account profile in the iPhone or Mac app is a different operation; it is not a Team selector.
The server decides invitation eligibility. If an existing account cannot accept an invitation, its Personal vault remains unchanged. Signing in, unlocking keys, or changing the selected organization does not bypass that policy.
Team roles do not grant access to another person's Personal vault, trust a device, unlock keys, reveal secrets, approve requests, or run commands. Shared Team vaults and multi-user approvals are unavailable in this beta. Being an owner or administrator does not bypass these boundaries.
Agent boundary
An agent should receive a typed reference or a limited capability instead of a raw secret whenever practical. A future mutation must offer an exact preview and use the same human authorization as its CLI equivalent.
Private-beta assurance
The current design is a candidate security model, not an external audit or production assurance claim. Unsupported operations are intentionally unavailable rather than simulated.