access: keeping the swarm manageable

A write that would leave its own writer unable to manage users
(deleting, disabling or narrowing its entry, removing the registry) is
refused; --protocol-writers can set a registry right that nobody may
manage any more.

Auth plan M1.

1 files changed, 13 insertions, 2 deletions

diff --git a/docs/access.md b/docs/access.md
index 042e0d5..b9e0296 100644
--- a/docs/access.md
+++ b/docs/access.md
@@ -88,5 +88,16 @@ curl -u alice --request PUT --header 'Content-Type: application/json' \
 ```
 
 From that write on, every node serves only the users the registry has, so the first
-entry must be the writer's own, with `["_continuum"]`, or nobody may change the
-registry again; add the other users the same way.
+entry must be the writer's own, with `["_continuum"]` (a first write that isn't is
+refused, `409`); add the other users the same way.
+
+## Keeping the swarm manageable
+
+A user may not lock itself out: a write that would keep its writer from managing users
+(enabled, with `write` on `_continuum/users`) when it could, deleting, disabling or
+narrowing its own entry, is refused (`409`), and nothing of it is written; so is one
+that would remove the registry (`_continuum/users`). Others are not kept from removing
+the last user who may manage users: each node can only judge what it holds, and two
+such writes on two nodes at once would leave nobody once they merge anyway. Then,
+while nobody may manage users, the users in a node's `--protocol-writers` may do
+everything there again, to set it right.