| API tokens | A long-lived secret on a disk is the problem we are solving. And under client-side encryption a token could not decrypt anything anyway, so it would be security theatre with a real cost. |
| A master key / break-glass account | A key wrapped into every vault is a single thing whose compromise reads everything, and it would void the invariant in the powerless-server bet. Ruled out permanently, whatever it is called. |
| Password-based login | There is no server-side account to log into. You are your keypair. |
| An "admin can read everything" mode | Administrators manage membership. They read what they were granted, like everyone else. |
| A background agent holding your keys | A daemon that keeps your key unlocked is a decryption service running on your laptop for anything that can talk to it. We use a short in-process cache instead. |