Identity

Four kinds of actor touch a workspace: people, the devices they carry, the agents that work for them, and the nodes that run beside your systems. Keys belong to people and machines. Agents get grants, which expire and can only narrow. And everything any of them does lands in history carrying the chain that authorized it.

There is no password anywhere in that arrangement, and none in the product.

Signing in makes a passkey

You sign in with Apple, Google, or Microsoft, or with a link sent to your email. Your device then offers to keep a passkey, and from that point signing in is your face, fingerprint, or device PIN. The biometric never leaves the device: Daslab receives a signature, not a fingerprint.

Passkeys here are the platform's own kind. An iPhone uses Face ID, a Mac uses Touch ID, a Windows workstation uses Hello, and a hardware key works where a company issues them. The emailed link remains the fallback for a borrowed browser or a locked-down terminal, so there is no machine you cannot sign in from.

Every device is a key of its own

The phone, the laptop, and the command line each enroll their own key on first sign-in, kept in the device's secure hardware. Keys never travel. What travels between your devices is nothing at all: each one proves itself.

This is what makes losing a device boring. Revoke the lost laptop in your account page and its sessions end, its key stops verifying, and no other device notices. There is no shared secret to rotate, because two devices never shared one.

Agents own nothing

An agent has no account, no API key, and no standing permission. Every job borrows its authority from whoever started it, through a grant. A schedule is a standing instruction, not a standing credential: each run it starts receives a fresh grant at start time, under whatever access its author holds that day, not the day it was written.

When a job starts another job, the child's grant is cut from the parent's, and the cut only removes. A sub-agent can hold less than the run that spawned it, never more. An agent cannot accumulate authority, because there is nothing for it to accumulate: grants expire in minutes and narrow at every handoff.

A grant states what it allows

A grant is a signed note: this workspace, this scene, these tools, reading as this person, until this time. Whoever presents it can act exactly that far, and anything that can check a signature can verify it, without asking Daslab first.

You have already used one. A share link is a grant made portable: it names the scene, reads as an outside visitor, and serves the Public layer and nothing else. A private run is another: its grant reads with your eyes and writes only to your layer, which is why a rehearsal stays yours until you move it.

History shows the chain

Open a scene's history and every entry answers two questions on the same row: who did this, and who let them. A human edit names the person. An agent's write names the job, the grant it ran under, and the person or schedule the grant descends from. The chain is part of the record, not a log kept beside it.

So audit is structural, not a side ledger: the history that runs the workspace is the audit, and it says the same thing to you, to a reviewer, and to the person whose name is on the grant.

Nodes verify on their own

A node beside your ERP checks grant signatures itself rather than calling home for every action. Work continues through a dropped uplink, and expiry is what gives revocation teeth: a grant that cannot be recalled from a node dies on its own within minutes.

The node itself enrolls like a device: one key, minted at install, revoked from the workspace when the machine is retired.

A company brings its own sign-in

Attach your identity provider to a workspace and its rules take over: people sign in through your SSO, joiners and leavers follow your directory through SCIM, and group membership decides what grants issuance will write. Daslab keeps no second list of your employees to drift out of date.

Nothing else changes shape. A solo account and a thousand-seat tenant use the same keys, the same grants, and the same history; a company adds rules at the moment grants are issued, and that is the only place rules exist.

What identity does not do

There is no permissions matrix. What a person may see is decided by where things sit, which is the layers page's whole subject, and what an agent may do is decided at issuance. Nobody administers a grid.

There are no service accounts, so nothing in a workspace runs as the machine user nobody remembers creating. And there are no passwords to phish, reuse, or leak: not because a policy forbids them, but because nothing here has one.

Updated 2026-08-14