What team access can and can't take back

This builds on How teams and trust work.

What “Can view” means

The server lets a viewer read a vault but not change it. A viewer’s devices still hold the vault key and could read all of it. It’s a permission the server enforces, not a cryptographic limit.

Removing a member

The member drops off the signed list and their vault keys are rotated: new keys are sealed only to the people who keep access, so they receive nothing new.

It can’t take back what they had. A removed member keeps the items and keys they synced, on their devices, for as long as those devices keep them. That’s true of any end-to-end encrypted system, since the server never had the plaintext to withdraw. Change credentials they may have seen on the servers themselves.

Access with an end date works the same way. When it ends, the member’s app closes the vault, the server refuses them, and the owner’s app asks for a rotation. Until then, the member still holds the current key.

Team policies

Policies are part of the signed list, so the server can’t change them. Each member’s app applies app rules, which a modified app could ignore; the server applies server rules, which a malicious server could skip while showing them as on. The server can read policy values and their reasons. See Set team policies and roles and Team policies.

Limits

• The server sees who’s in which team, which vaults exist, who may open them, their item counts and sizes, and when things change. Never what an item contains.
• The server can withhold new lists or items, keeping a device on an older but genuine state. It can’t forge newer ones.
• A team is as strong as its members’ oldest app. An app from before the signed list keeps the older, weaker behaviour.

Threat model: teams and devices puts these next to the other cases.