Spaces and membership

A space’s membership is a Keyhive group: the identities that may replicate the space, each with an access level. Spaces and databases covers the data in a space and how it replicates; this page covers who gets it.

Model

Members. Each member is an identity, named by its DID, with one access level. The levels are ordered, and each includes the one before:

Access	The member can
pull	Receive the space’s data in encrypted form, for example a sync service
read	Read the space
edit	Read and change the space
admin	Change membership: invite, change roles, remove members

The identity that creates a space is its first admin. Levels come from Keyhive.

Membership policy. invite admits new members through invitations. locked admits no one new, which suits a space that should stay private to one person or a fixed group.

How access is checked. Membership is a graph of signed delegations and revocations. Each delegation, such as “admit this identity with edit”, is signed by a member allowed to make it, and no member can delegate more access than it holds. Every peer keeps the graph and checks each operation against the members it already trusts, so a peer decides whether to accept another peer’s changes without asking a server. Delegations and revocations converge: peers that have seen the same ones agree on the membership, whatever order they arrived in.

Who can revoke whom. An admin can revoke any member. Any other member can revoke only members it has causal seniority over: members whose delegation depends on its own, because it admitted them or admitted whoever did. A revocation that breaks this rule fails with NotAuthorizedError.

Encryption. Keyhive keeps a group key that the current members share. A space’s changes are encrypted with it, so a member with pull stores and relays the data without reading it. When membership changes, the key changes too.

EDGE. EDGE, DXOS’s sync service, joins a space as a pull member. It holds and relays the encrypted changes, so devices that are never online together still sync, and it cannot read them. A service that works on plaintext, such as AI or search, needs read, which an admin grants explicitly.

Behavior

• An admin can invite members, change a member’s access with Space.updateMemberRole and remove a member with Space.removeMember.
• Peers reject changes from an identity whose access does not allow them.
• Removing a member is a revocation, and it rotates the space’s key. They stop receiving new changes, and could not decrypt them if they did.

Limits

• Removal does not reach data the member already has. A removed member keeps their copy of everything they could read before.
• Access applies to the whole space. To share part of the data with fewer people, put it in a separate space.