Access control

Access changes are repository changes. GitVaulty separates public identity registration from the manager-approved grant, so a pull request can show exactly who is being introduced and who approved their access.

Register a developer

The new developer registers their public recipient on their own branch:

npx gitvaulty user register
git add .gitvaulty/recipients.json
git commit -m "chore: register alice's GitVaulty key"

Only public material is committed. Their private GITVAULTY-IDENTITY-... backup must remain private.

Grant group access

After reviewing the registration, a manager adds the user to the default team group:

npx gitvaulty group add team alice
git add .gitvaulty/recipients.json .sops.yaml
git add -u -- '*.gitvaulty'
git commit -m "chore: grant alice team access"

The command appends a manager-signed policy revision and re-encrypts affected files for the updated recipient set. Alice can decrypt them after the access commit is merged and pulled.

Use narrower groups

Create a group for a subset of secrets, add members, and select it when creating a file:

npx gitvaulty group create production
npx gitvaulty group add production alice
npx gitvaulty create deploy/token.txt --group production

Use gitvaulty access to change the groups or direct users assigned to an existing file. GitVaulty verifies that your own user remains among the effective recipients.

Offboard a user

Remove the user from affected groups, remove any direct grants, and then remove their public registration. Re-encryption prevents the removed identity from decrypting future ciphertext, but it cannot revoke plaintext or historical ciphertext the person already possessed. Rotate underlying service credentials when the security boundary requires it.

See the user and group command families for the full management reference.