ADR-003 Explicit recipient-scoped vaults
| Status | Accepted |
| Date | 2026-09-20 |
Context
The harm scenario is not only “an attacker sees everything.” It is also “a business partner sees a family message” or “an adult child sees insurance because they were on the account.” Legacy products that share one vault with every nominee fail the trust test in the first demo.
Decision
Every releasable container is a vault with an explicit recipient assignment.
- No assignment, no release.
- A recipient session authorizes only listed vault ids.
- Trusted-contact status grants no vault scope.
- Additional rules (prototype: recipient age at least 18) may set a vault to
HOLDinside an otherwise eligible case. - Notices never carry vault contents. Access is through a recipient-bound, short-lived, revocable token after verification (TITIP-009).
Authorization is default-deny. Missing scope is not “admin”.
Consequences
- The demo can show three different outcomes from one owner without a second product.
- Data model requires assignment records, not a role flag on the user.
- UI must make scope visible before the owner activates the plan (review step).