Example · an animated walkthrough

A message between two agents.
A fact arrives. A person does not.

Hannah's agent writes to her organization's agent. The organization reads only from members who are adults — and does not want to know which member wrote. Watch one signature from Hannah, one stamp from a key that never leaves its safe, a public notice board instead of a phone call, and two receipts.

The essay this example comes from A day in the town

The animation

One street. Eight scenes. Press play and a narrator walks you through it.

Hannah's side of the street is on the left; the organization's is on the right; the public notice board is on the corner. The card in the corner of the picture says who is acting and what passes between them; the light on the ground follows them. Turn the narration off to read at your own pace, or step with the arrow keys.

1 / 8 · Meet everyone · ← → to step, space to pause

01 · MEET EVERYONE

Let's meet everyone. On the near side of the street lives Hannah. Beside her stands her agent — a piece of software that runs errands for her. Next to her home is her vault, where she keeps private things, including a membership card her organization gave her. It says two things: she's an adult, and she's a member. The card is tied to a key, and that key sits in a key safe that never opens. Across the street is the organization. Its own agent waits at the door, and inside, the steward reads the mail. On the corner is a public notice board, where the organization has posted its stamp, and the list of cards it still vouches for. Keep your eye on three things that will never cross the street: the card, the key, and Hannah's name.

Three things never leave her side of the street: the card, the key, and her name.

01Who is in the picture

Two people, two agents.

A person signs at the start and a person reads at the end. Everything in between is done by agents under what the people decided.

Hannaha member

The person in the loop. She signs one permission at her own front door, and she can cancel it from the same door. She never appears in the story by name, address or key.

The stewardreads the mail

The other person. At the end, the steward is handed a message from "an adult member". The steward gets the message, not the sender.

Her agentdoes the legwork

Fetches the card and the permission from her vault, makes the proof, walks to the key safe, carries the message across the street, brings the receipt home.

The organization's agentat the door

Asks its own question, checks the answer against the public notice board, and only then hands the message inside.

02Scene by scene

What happens in each scene, and the rule it keeps.

Who acts, who receives, what passes between them — then the scene in a sentence, and the rule it keeps.

1
Meet everyone
Hannah lives on the near side of the street with her agent. Her vault holds the membership card her organization gave her — adult, member. The key that card is tied to sits in a key safe and never comes out. Across the street: the organization, its agent at the door, the steward inside. On the corner, a public notice board where the organization has posted its stamp and the list of cards it still vouches for.
Three things never leave her side of the street: the card, the key, and her name.
2
Hannah signs one permission
Hannah → her vault · one signed permission: prove "adult member" to this organization, until spring
At her own front door, once, Hannah signs: "My agent may prove I am an adult member — to this organization, until spring." The permission goes into her vault. It says where, what and until when. It does not say who she is.
A person signs. Everything that follows runs under that one signature.
3
The organization asks its own question
the organization's agent → Hannah's gate · "Adult member? Prove it." — question #4821, good at this door only
The organization's agent reads mail only from adult members. It sends a fresh question to her gate: "Adult member? Prove it. Question #4821, for this door only." It does not ask for a name, a card or a birthday.
The receiver asks its own question. It never sees the card.
4
Her agent makes the proof at home
her vault → her agent · the card and the permission — they stay inside the house; out comes a sealed proof: "adult member — yes"
Her agent takes the card and the permission out of the vault, inside the house, and makes a sealed proof: "Adult member — YES." The proof answers the question. It does not carry the card, the birthday or the organization's signature on the card.
The proof says the answer is yes. It does not say what the card says.
5
The key safe stamps it — once
her agent → the key safe · "stamp this — for the organization, question #4821" · the safe checks her permission, then stamps once; a slip for another organization gets nothing
The proof needs one stamp from the key tied to her card. Her agent brings it to the key safe with the permission. The safe checks: this organization? this question? under her permission? Yes — one stamp. A slip for a different organization gets no stamp at all.
The key never leaves the safe, and the safe stamps only what her permission covers.
6
The message crosses the street under a pen name
her agent → the organization's door · the message, from a pen name made for this organization — the stamped proof inside
Her agent carries the message across the street with the sealed, stamped proof inside. The envelope is signed with a pen name made for this organization alone. A different organization would see a different pen name.
Different door, different pen name. Never her name.
7
The door checks the notice board, not the office
the organization's agent → the public notice board · "real stamp? card still vouched for? #4821 unused?" — yes · yes · unused. The membership office is never asked.
Before anyone reads the message, the organization's agent walks to the public notice board: Is this stamp really the organization's? Is the card still vouched for? Has question #4821 been used before? Yes, yes, no. It never phones the membership office.
Trust is read off a public board. The issuer is never asked.
8
The steward reads — and two receipts
the door → the steward · and back to her vault · "a message from an adult member" to the steward; a receipt for the organization (a fact, no name); a receipt for Hannah (with the permission it ran under)
Now the steward gets the message: from an adult member. Not which one. The organization files a receipt that says a fact and a question number. A receipt also walks back to Hannah's vault, with the one thing the organization can never hold: the permission it ran under. She can cancel that permission from her front door, any time.
The organization knows a fact. Hannah keeps the whole story, and the off switch.

03Who learned what

At the end, five parties hold five different things.

The organization

That an adult member wrote, and that the card came from its own issuing stamp. A pen name it will see again from the same sender at the same door. A question number it has now used up.

never: a name, a birth date, the card, her address

Hannah

Everything the organization learned, plus the one thing it cannot hold: the permission the whole thing ran under. Her receipt is in her vault and goes where she goes.

two receipts, two truths

The key safe

That it stamped one request, for this organization and this question. It saw a fingerprint of the proof. It never saw the message, the card or the proof itself.

a log line, not a copy

The membership office

Nothing. It was never asked. The door read the stamp and the valid-cards list off the public notice board.

issuing is not a phone call

A second organization

Nothing that links back. A different door gets a different pen name, a different question number and a proof that shares no visible part with this one.

unlinkable by construction

04The drawing, decoded

What the picture calls it, and what it really is.

Every object in the drawing stands for one real thing in the system. None of them is a metaphor for something the system does not have.

In the drawing	What it really is
Her vault	Her encrypted record store. Holds the membership card, her permission, and later her receipt. Her agent reads it under her grant; nobody else does.
The membership card	A credential the organization issued to her: adult, member. It is tied to a key, so only the holder of the key can present it.
The key safe	A key service on a sealed machine in her estate. The key never leaves it. It signs once per request and only when the request is covered by her permission — and it checks that itself.
Her permission	A signed, standing delegation from Hannah to her agent: present this card, to this organization, for this question, until this date. It says where and until when. It does not say who.
The sealed proof	A zero-knowledge proof: it shows the statement 'over 18 and a member' is true about a card the organization issued, without showing the card, the birth date, or the organization's signature on the card.
The pen name	A pairwise account derived for this organization alone. The same organization sees the same pen name next time; a different organization sees a different one.
The public notice board	The chain. Where the organization has registered its stamp (its issuing key) and publishes the root of the list of cards it still vouches for. Anyone can read it; no one has to ask.
Question #4821	A single-use challenge the organization makes up for each request. It stops a proof from being replayed and pins the proof to this door.

05Why the key safe matters

One stamp, from a key the agent does not hold.

The card is tied to a key. Showing the card means proving you control that key — and that is the one moment in the story where a signature is needed. In most systems that key sits on the person's phone, so her agent cannot use it; in the lazy design the agent simply holds the key and becomes her.

Here the key lives in a key safe on a sealed machine. Her agent does not hold it. What her agent holds is her permission: present this card, to this organization, for this question, until spring. When the proof needs its stamp, the safe is shown the permission and the exact request — which organization, which question — and it stamps only if the permission covers it. It checks that itself; it does not take the agent's word for it.

That is why scene five shows a second slip getting no stamp. A safe that would stamp anything would make the agent into Hannah. A safe that stamps only what her permission covers makes the agent a delegate — and a delegate is something she can revoke from her own front door.

What the key safe never sees

The message. The card. The proof. It is handed a fingerprint to stamp and a note saying which organization and which question. Its log says a stamp was made for that note — not what the message said.

Two ways to show the same card

This story uses a sealed proof: the organization learns a fact and no values. If the receiver were the dues ledger, which is entitled to her member number, the same card would be shown with that one field open and the rest closed. Which way is used is decided by the question — and a request for a fact can never be answered with a value.

06For engineers

This is a live gate, not a storyboard.

The door

A federation estate's A2A door requires the predicate proof grade for this skill. The gate predicate-visitor runs nightly against it, with a negative twin that must be refused.

The key safe

The key service added a P-256 curve and an ES256 purpose that signs only under bound evidence — digest, venue, predicate digest. The gate is green on it with no local-key allowance.

What is still open

The replay check is the asserted grade, the valid-cards proof is a signed root rather than an in-circuit path, and the key safe is one operator on one machine. Each is named, with its cost to close, at the end of the essay.

The open items, one by one Another example: Game Night

The receiver asks its own question. The person is never the answer.

A door that needs a fact gets a proof. A door entitled to a value gets the value and nothing else. The key that backs the card stamps only what a signed permission covers, and the permission is hers to cancel. That is the whole example.

Read the essay Build on it

A message between two agents.A fact arrives. A person does not.

One street. Eight scenes. Press play and a narrator walks you through it.

Two people, two agents.

What happens in each scene, and the rule it keeps.

Meet everyone

Hannah signs one permission

The organization asks its own question

Her agent makes the proof at home

The key safe stamps it — once

The message crosses the street under a pen name

The door checks the notice board, not the office

The steward reads — and two receipts

At the end, five parties hold five different things.

What the picture calls it, and what it really is.

One stamp, from a key the agent does not hold.

This is a live gate, not a storyboard.

The door

The key safe

What is still open

The receiver asks its own question. The person is never the answer.

A message between two agents.
A fact arrives. A person does not.