docs: reading keys and declarations

Clients checking signatures or sealing read the registry and
_continuum/access: operators grant reading them.

Auth plan M7, M8 (docs).

1 files changed, 18 insertions, 0 deletions

diff --git a/docs/access.md b/docs/access.md
index 4a0fd0e..83c39f9 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -277,6 +277,24 @@ over it, as `ssh-keygen -Y sign -n continuum-value` makes it, with one of its `k
 it logs in by key, writes and deletes signed values (`put config '{"mode": "fast"}'`),
 and checks one against its user's keys (`verify config`).
 
+What a client reads to check a signature, the signer's keys, is in the registry, and
+whom to seal for (Values sealed for their readers, below) in `_continuum/access`: both
+protocol data, which a user's capabilities cover only if given so. Neither holds
+secrets (every member holds the document), so give the users who check or seal reading
+them:
+
+```sh
+curl -u alice -X POST -H 'Content-Type: application/json' \
+  --data '{"path": ["_continuum", "users"], "rights": ["read"]}' \
+  http://localhost:3000/admin/users/bob/caps
+curl -u alice -X POST -H 'Content-Type: application/json' \
+  --data '{"path": ["_continuum", "access"], "rights": ["read"]}' \
+  http://localhost:3000/admin/users/bob/caps
+```
+
+Under a strict policy, the same, as part of bob's entry, signed (`continuum-signed put
+_continuum/users/bob '{…}'`).
+
 A node takes one only from that user, for that path, replacing what is there, by one
 of the user's keys, and if the user may write there ([`api.md`](api.md), Signed values);
 it writes nothing else there, nor within or above such a value (`409`), and the users