ZEROGRANT
You hold everyone's data.You can never give it back.
Applications need permission, not possession. ZeroGrant lets you borrow authority while the owner keeps control, and revoke ends the loan.
Sandbox never charges. Owner keys never touch your infrastructure.
Why this exists
If your application only needs the answer, why does it still own the evidence?
Permanent custody was never a product requirement. It was an architectural limitation. Sovereignty Theft is the cause: irrevocable handover of authority. Not the stealing of data. The stealing of authority.
What custody costs you now
The bill permanent custody is already running. Every number is third-party and current. The exposure remains yours until the architecture changes.
The payoff
A database breach no longer scales.
No plaintext database to steal. Every record requires a separate, live, authorised operation. Bulk exfiltration no longer produces bulk-readable data.
Traditional breach
Steal once. Read everything.
One exfiltration, and every row is plaintext the attacker can use forever.
48 records. 48 readable.
With ZeroGrant
- Steal the database. Receive ciphertext.
- Each record still requires live authority and an individually authorised operation.
- Decrypting millions of records means millions of governed attempts. Rate limits constrain it. Anomaly detection exposes it. Revocation ends it.
- Revoked records never open.
48 records. 4 live. 44 inert.
A breach finds nothing that works at scale.
What ZeroGrant does
Use only the data you need. For only the purpose granted. For only as long as authority exists.
ZeroGrant verifies live, purpose-bound authority and returns only the permitted result. Owners can grant, limit, and revoke access at any time.
No plaintext database
A stolen database yields ciphertext, not bulk-readable records.
Exact-scope access
Authority can cover a single field, fragment, claim, or derived answer, not the entire record.
Immediate revocation
Withdraw authority and every dependent permission ends.
Restore-proof enforcement
Restoring an old database cannot resurrect withdrawn access.
A scoped clearance intent
The application receives the answer it needs, not the evidence behind it.
Declare the purpose, the exact claims you want back, and the data that must stay excluded. Set the lifetime. ZeroGrant enforces it and returns proof, never raw evidence.
{
"purpose": "verify_employment_eligibility",
"requested_claims": ["eligible_to_work"],
"excluded_data": [
"passport_number",
"date_of_birth",
"home_address"
],
"expires_at": "2026-07-28T12:00:00Z",
"raw_data_exposure": false
}Live proof
Control stays with the owner.
They never transfer authority. They delegate it. Your application acts while that authority exists. Withdraw it, and every dependent permission dies with it.
The clearance result is what your application keeps: a bounded answer, a cryptographic proof, and raw_data_exposure: false.
// delegated authority. no permanent custody.
{
"intent_id": "ci_a1b2c3d4e5f678901234",
"result": {
"eligible_to_work": true
},
"raw_data_exposure": false,
"cryptographic_proof": "ntka_v1:b8d828…"
}How it works
Borrow authority. Act. Revoke.
Consent is continuous, not a one-time checkbox. Your application acts under delegated authority while it exists. The owner can end the loan at any time. Enforced by cryptography, not by a promise to delete.
- 01
Request access with purpose
Your server opens a ClearanceIntent. Nothing moves until the owner grants. Status stays requires_owner_action.
- 02
The owner grants, not transfers
They review the purpose, recipient, scope, and lifetime, then approve or decline. Access is delegated, never owned.
- 03
Act under live authority
Perform only what the grant allows while authority exists. The application receives the approved result, not reusable source data.
- 04
The owner ends the loan
Revoke at any time, no reason required. Future use ends, and restoring an older system state does not bring it back.
Prefer code first? Open the quickstart.
The architecture
Legacy versus SDARC.
Permanent copy versus conditional ciphertext. Transferred authority versus borrowed authority. Withdrawn access stays withdrawn.
Legacy
- The copy is permanent.
- Authority is transferred.
- Consent becomes a permanent copy.
- A breach is a catastrophe.
SDARC
- The copy is conditional.
- Authority is borrowed and revocable.
- Consent can be withdrawn, and the data reflects it.
- A breach finds nothing that works at scale.
Data flow
Legacy
- Application
- Database
- Plaintext
- Breach
- Everything
ZeroGrant
- Application
- Ciphertext
- Authority
- One answer
- Revoked
Same application. Different terminus. Everything or one answer, revoked.
Two guarantees
Revocation survives restore.
A restored backup must not turn withdrawn consent back into live access.
SDARC enforces that outcome cryptographically. Restore an old system state and revoked authority stays revoked.
Bounded results, not reusable source data.
Applications ask for the exact answer they need and declare what must stay excluded.
ZeroGrant returns the approved output and evidence of its scope. It does not hand the recipient a reusable copy of the underlying record.
Origin and fit
A protocol proven where custody was most punishing, ready wherever an individual's data must stay under their control.
Proven under pressure
Built for cognitive and workplace profiles, where permanent disclosure destroys trust.
Source-agnostic
Works above any assessment, record or profile store.
Exact-scope control
Governs which field, for which purpose, to which recipient and for how long.
Start in your workspace
Install the SDKs, create an intent, and prove delegated access in sandbox. Owner keys remain on the owner's device. Your server stores ciphertext and receives only authorised results.
The internet learned how to identify people.SDARC teaches it how to leave authority with them.
Build with ZeroGrant.
ZeroGrant builds SDARC. Delegated by consent. Bounded by purpose. Revocable by design. Provable by cryptography. Sovereign for life.