Personas

Status: Accepted · Version: 0.1

Personas are roles in the trust model, not marketing segments. One human may hold more than one role. The wife in the prototype demo is both a trusted contact and a recipient. Those capabilities are still separate.

Owner

The person who creates the Titip account and decides what is recorded and who may someday see it.

Prototype example: Iman.

Needs: a short path from welcome to an active life check; a clear picture of what is documented; confidence that silence will not dump everything.

Must be able to: confirm presence at any escalation state and return to active; change trusted contacts and rules, which creates a new policy version rather than overwriting history.

Trusted contact

A person the owner asks to help confirm that escalation is real, not to inherit the account.

Prototype example: Iman’s brother. His wife may also be a trusted contact.

Needs: a plain invitation (“Iman menunjuk Anda sebagai trusted contact.”), a way to accept or reject, and a single notification channel they control.

Must not: receive vault contents merely because they are a trusted contact. Confirmation is evidence for the state machine, not a release.

Recipient

A person assigned one or more vaults. They see only those vaults, and only through the delivery rules.

Prototype examples:

Must not: browse the owner’s other vaults, trusted contacts, or account settings.

Reviewer

A human who performs the manual safety review before a non-simulated release. In the prototype this role is exercised by simulation output, not by a real approval that delivers data.

Needs: the evidence list, the policy version, and the exact recipient-to-vault mapping. Must be able to hold or reject.

Platform operator

An employee or on-call engineer. They may need to place a global release hold. They must not have standing access to vault plaintext. Employee access is a production-readiness control, specified in policies/security.md and plans/production-readiness.md.

Stakeholder (prototype)

Pak Sonny, his friend, and Mike. They need to understand the product in one sitting. They are not users of the trust model. The prototype succeeds if the six use cases in plans/prototype.md make the positioning obvious.