NIP-DA · Scoped Data Grants
Revocation isn't a policy. It's a key rotation.
Permissioned private data sharing on nostr. Publish one encrypted record under your own key, hand its key to whoever needs it, and take them out by rotating the key — their copy simply stops opening. No account to close. No company in the middle.
Today, your details live in a hundred other people's address books, CRMs, and spreadsheets — N² rotting copies, each stale the moment you move, each a breach waiting to happen, none of them yours to correct. Scoped Data Grants flips it: you keep one authoritative, encrypted record of your own data and grant scoped, revocable access to specific keyholders. Everyone else holds a capability — a pointer plus a decryption right — that always dereferences to your current truth. N self-maintained records instead of N² decaying ones.
You grant access by delivering a key to a grantee's nostr pubkey — gift-wrapped, so relays never learn who granted what to whom. No permission table on anyone's server.
To cut someone off, you rotate the scope key and re-grant the rest. Their old key opens nothing. Revocation isn't a request you hope a platform honors — it's math.
Built entirely on NIP-44 (encrypted payloads) and NIP-59 (gift wrap), over plain NIP-01 addressable events. Relays store only ciphertext and require zero changes.
Your encrypted record, addressable and replaceable. Symmetric-encrypted under a scope key. Republish to update — every grantee instantly reads the new version. This is what makes grants live.
An unsigned rumor that delivers a scope key to one grantee, sealed and gift-wrapped (kind 1059) per NIP-59. Relays see only an ephemeral key handing an opaque payload to a recipient — the grant graph stays private.
An optional, gift-wrapped courtesy: tells a revoked party their access ended so their client can mark the data stale. Silent revocation works too — the rotation already did the work.
Your private, self-encrypted ledger of grants issued and received. For the publisher it's the record needed to rotate; for the grantee it's the real address book — recoverable from your key alone.
This isn't a proposal waiting on infrastructure. It's a complete draft with two independent implementations that interoperate live on public relays — sharing nothing but the spec.
A JavaScript reference library (isomorphic Node/browser) and a Go CLI on go-nostr. Each decrypts the other's scopes, detects the other's rotations, and rebuilds the address book from the other's Grant Index — 5 cross-implementation assertions, live.
npm run demo narrates the protocol on an in-memory relay; npm run smoke
runs 11 assertions against real public relays; npm run seed plants a throwaway
graph and prints a login key. All in the repo.
The best argument for a primitive is what it carries. Each of these is a pure client — no server, no build step — vendoring the same ~300-line library.
The spec is complete, the code is public, the interop is proven. What it needs now is your reading, your critique, and your apps.