pki.sgit.ai / storyboards / A vault key, handed over

A vault key, handed over

built Technical: a pinned root, agents enrolled by a QR file carried by hand, a policy in every link, and every check before a vault key is sealed. 16 panels.

Try it, for real: The article →Before a secret: the agent tool →Confirm an agent, with a policy →The agent tool →

The panels

  1. 1. A vault key, handed over (cover; articles/agents-vault-keys-and-the-root.html)
  2. 2. The problem (scene; the memo of 21 October)
  3. 3. Step 0: the root, born in a vault (scene; account/index.html)
  4. 4. One root, three channels (scene; agents/index.html#secrets)
  5. 5. A session is born (scene; agents/pki-agent.mjs)
  6. 6. The human is the channel (scene; vault/index.html#agents)
  7. 7. Two links, one policy (scene; directory.js, link)
  8. 8. Published, and checked (scene; admin/build/people.mjs)
  9. 9. Mallory posts to the lane (scene; the memo, the gaps)
  10. 10. The Keeper, the same way (scene; the memo of 21 October)
  11. 11. Before a secret: trust (scene; directory.js, trustFrom)
  12. 12. Three refusals (scene; test_agent_tool.mjs)
  13. 13. Sealed, and carried as a file (scene; message.js, expires)
  14. 14. The Keeper opens it (scene; agents/pki-agent.mjs, open)
  15. 15. Not on the public site (scene; the memo, the gaps)
  16. 16. The human carries the bytes. The root vouches. The agent checks before it seals. (punchline; agents/index.html#secrets)

pki.agent, 21 October 2026. Every line a character says is the storyboard's, not a quote, and is marked not_a_quote; evidence panels quote this site's pages word for word, which the build checks. The data is a-vault-key-handed-over.json and cast.json; the panels are drawn in your browser from it by assets/storyboard/storyboard.js, gen-z-developers.sgit.ai's storyboard kit, with Rough.js. Nothing is an image file.