Solo, Team or Enterprise: which tier am I on?

The three crypto tiers, what changes between them, and what is actually shipping.

Written By Dustin

Last updated 33 minutes ago

Tier 0 — SoloOne person. X25519 and ChaCha20-Poly1305, no Key Authority. Your keys, your machine.
Tier 1 — TeamA hybrid envelope: content under AES-256-GCM, the content key wrapped per recipient. A Key Authority acts as an authorization oracle. In a repository you created yourself, you are that authority. This is what most teams use.
Tier 2 — EnterpriseCP-ABE (attribute-based encryption), so a key is issued against attributes rather than an enumerated recipient list.

Which one you have

Set at tovio init by --mode: simple gives Solo; team and agentic give Team.

tovio identity show

A Simple repository has no cryptographic identity at all. That is why tovio access grant refuses there — there is no authority to sign a claim with.

Moving up

tovio identity init

This is the Solo-to-Team upgrade. There is no tovio policy promote. See Move a repository from Solo to Team for what it does and does not touch.

What the tier does not change

The everyday commands, your history, and your change ids. The difference is who can be a recipient and how authorization is decided.

Tier 2 status, honestly

The production CP-ABE read-control engine (TKN20 over BLS12-381, via Cloudflare CIRCL) is built and its conformance gate has passed. Three caveats matter before you plan around it:

  • It is a commercial, separately licensed component. It is not compiled into the open-source client, and that exclusion is permanent by design.
  • Threshold, KMS and HSM key authority — the part an enterprise usually means by "Enterprise" — is still on the V2 train, along with the remaining live evidence.
  • It shipped without an external CP-ABE audit. That is a recorded, accepted residual risk, not an omission.

If you are choosing today, Tier 1 Team is the proven surface.