Give someone access

tovio access grant --identity ./peer.identity.pubtovio access grant --identity ./peer.identity.pub --attr role=backend --attr team=payments

Enrols a recipient and issues them signed attribute claims. Policy conditions test those attributes.

--identity is a file path

It is the path to the recipient's identity.pub file — not a hex key you paste, and not a DID. A positional argument is rejected outright:

tovio access grant peer.identity.pub          # error: exit 2

The grant is prospective

This is the fact that surprises people. Granting does not re-wrap content that is already committed. The command says so itself:

✓ Granted access to did:key:…  • role=backend  Takes effect on the next commit of a matching protected path.

So a new teammate cannot read yesterday's protected commit until that path is committed again. If they need existing content now, touch and commit the path, or re-seal it deliberately. Do not assume the grant alone opened history — verify.

(Revocation is the asymmetric case: it re-seals HEAD and writes a commit immediately.)

Getting their identity file

They run tovio identity show and send you their identity.pub. It is public — no secure channel needed — but confirm the DID out of band. The file binds a signing key to a key-agreement key, and a crafted file naming someone else's signing key beside the sender's own wrap key is exactly the substitution this check exists to stop.

It needs an identity to sign with

On a Simple repository this fails: there is no key to issue claims with. Run tovio identity init first.

Edge cases the command handles for you

• Granting to yourself is a no-op — the owner is always a recipient.
• Granting the same person again replaces their claims for those attribute names rather than adding duplicates.
• Enrolling with no --attr at all leaves them satisfying only ANY and negated policies. The command warns about this.

Verify it worked

tovio access listtovio access check <path> --identity ./peer.identity.pub

Attributes, not paths

Grant role=backend rather than a list of paths. Policies decide which paths that attribute opens, so adding a path later needs no re-grant.

Requests

tovio access requests

Lists pending requests from people who asked for access themselves.