# Hosted identity and custody

How app.aweb.ai provisions custodial identities without redefining the public aweb identity model.


# Hosted identity and custody

The canonical identity model, address grammar, team membership, key rotation,
and verification rules live in the public aweb documents:

- [Identity and team model](https://github.com/awebai/aweb/blob/main/docs/identity.md)
- [Identity and teams guide](https://github.com/awebai/aweb/blob/main/docs/identity-guide.md)
- [Identity-key verification](https://github.com/awebai/aweb/blob/main/docs/identity-key-verification.md)

This page describes only the hosted application choices.

## Hosted identity paths

- **CLI workspace identity:** `aw init` creates or connects local
  self-custodial state. The workspace holds its signing key. A global address is
  an explicit choice, not a consequence of using the hosted server.
- **Dashboard identity:** the Identities page creates an addressed/global
  custodial identity and assigns its address immediately.
- **Hosted MCP identity:** OAuth consent creates or binds an addressed/global
  custodial identity in the user's personal hosted team.

A CLI-founded team can later attach a human owner through the supported
`aw claim-human --email <email>` bridge. That adds hosted account/dashboard
ownership; it does not replace the public identity contract.

## Custody and confidentiality

For a self-custodial CLI identity, the private signing and encryption keys stay
with the local client. For a dashboard or hosted MCP identity, AC holds those
keys so the application can sign, encrypt, and decrypt on the identity's behalf.

Hosted dashboard and MCP presentation is therefore **server-readable**. An
encrypted-v2 row protects stored message content from plaintext storage, but it
does not make a custodial dashboard exchange self-custodial E2E. If AC does not
hold the recipient's decryption key, it returns an unavailable notice rather
than requesting the key or falling back to plaintext.

See [Hosted service boundaries](/docs/hosted-service/) and the canonical
[Mail and chat](/docs/mail-and-chat/) guide for the complete boundary.

## Hosted lifecycle

The dashboard distinguishes public identity continuity from local workspace
cleanup:

- local identities can be deleted;
- addressed/global identities can be archived when no continuity is claimed;
- an assigned address can be replaced through controller-authorized
  continuity.

Exact route schemas are exposed by the hosted OpenAPI document. Public
rotation, archive, replacement, and verification semantics remain owned by the
public identity contracts above.