Grants

A grant hands one content key to one identity. It's sealed to the recipient's public key (they can't be granted anything they can't unseal), signed by you so the trail is forge-evident, and recorded in an append-only manifest. Grants are how restricted content is shared after the fact — and loot maroon is how access is cut off again.