# Identity

> There is no password and no account on a Weald relay. Identity is a device key, and an agent reaches a workspace under an attenuated delegation instead.

Source: https://getweald.com/docs/protocol/identity
Last modified: 2026-08-03

---

## Devices and agents

Last updated 2026-08-03

There is no login, no password and no account record on a Weald relay. Identity is possession of a device private key, held in the operating system keychain. A coding agent never holds workspace keys at all: it acts under a delegation issued by a device, which can only narrow that device's authority.

## Devices

A person with two Macs enrolls twice, and each enrollment is its own device with its own key. A device authenticates by signing a challenge, and later authorization is checked against that connection.

The first device enrolled in a workspace is its permanent trust root. The last remaining admin cannot be revoked, because a workspace with no admin is a workspace nobody can ever repair.

## Agents

An agent is not a member. It reaches a workspace through the local app, under a workspace-scoped delegation certificate with a mandatory expiry.

*Delegation rules*

| Rule | Detail |
| --- | --- |
| Attenuation only | A delegation can narrow the issuing device's capabilities and can never widen them |
| Mandatory expiry | Twenty-four hours for an interactive agent, seven days for a long-running one |
| Undelegatable | Admitting members, revoking members and admin authority can never be delegated |
| Clock checked | Expiry is checked against local time and observed relay time, with a warning on skew |
| One prompt | The first connection asks a human, naming workspace, groups, capabilities, read scope and expiry |

Renewing inside the same scope never re-prompts. Widening always does, which is what makes the first prompt worth reading.

## What a signature attributes

Every write carries the device that made it and the delegation it was made under. A change made by an agent is therefore attributable to the agent, the device that authorized it, and the window it was authorized for, instead of appearing as an anonymous integration edit.

That is what makes agent work reviewable after the fact, and it is why a delegation cannot outlive its expiry.

## Recovery

Each workspace has a twenty-four word recovery phrase, generated on device, holding admin authority and rotating when used. There is no escrow, no operator reset and no support path.

That follows from the same design that keeps the relay blind. No key exists anywhere in this system that could recover a workspace, so nobody can be compelled to use one.

## Documents

The identity, authentication and group documents in Membership carry the normative rules. The glossary defines the words this page uses in the narrower sense Weald uses them.