The matrix has eleven door columns. Some doors take any number of people. Some take exactly one.

​
Doors that anyone can hold

​
Doors that take one person only

The layout is two fixed SiYuan containers, one for each of them. A third person would need a third container.
The application is single-tenant. One dataset, one CV, one salary history, one set of portal credentials. Granting it to a second person hands them Herman’s data rather than giving them their own.
cognee holds every agent session from every machine. It is the most concentrated store on the box. A second holder would get everything, not a memory of their own.
copyparty serves one filesystem tree for each volume. A second account would not get storage of its own. It would get write access to ~/workspace/sync and read access to the whole of ~/workspace.
These boxes are greyed out rather than hidden. The matrix stays rectangular and the reason stays visible.

​
Shared logins

Chat and Hermes each have one login, not one for each person. Their controls are radio buttons. Choosing a person moves the login to them.

​
Two doors that behave differently

​
Career writes two stores

Caddy is the outer gate. KasmVNC serves the /takeover viewer behind its own authentication, and Caddy forwards the header to it. The same password must exist in both, or /takeover refuses after the door has already let you in.
The viewer uses ~/.kasmpasswd-career, a separate store. Sharing the desktop’s ~/.kasmpasswd would silently couple the career and desktop passwords.

​
The LLM door holds two different credentials

Ticking the LLM box when the person already holds a key does nothing. The window does not open.
Before 20 August 2026 a tick reissued the key every time. That stopped every browser and CLI holding the old key, behind a checkbox that nobody reads as destructive.
To replace a key: untick, then tick. Unticking deletes the key, so tell the person first.
A key cannot be paused. LiteLLM needs the key text to block it, and the server keeps only a hash. The key exists or it does not.

​
Deleting a person

Del is not the same as unticking every box. Del destroys the person: every credential is dropped and the roster entry is removed. The delete now revokes every door that the person holds, and it reports a revoke that failed.
Before 20 August 2026 the warning listed seven doors and the delete revoked only five. Deleting somebody who held career, tools, memory or drive removed their row and left those credentials live, while the status line said “all doors revoked”.
Both the warning and the delete now read one list, $script:RevocableDoors, so they cannot drift apart. A failed revoke reports this instead of success: