The P in PDS

AT Protocol gives every person a PDS. That letter P means Personal. Almost nobody notices how much that letter decides.

Your posts, likes, and follows live in a repo that belongs to you. You can move the repo to another host and keep your identity. For social software, that is the point. It is why the protocol is worth building on.

Then you try to keep a company's files there.

Where personal stops being right

A designer joins your company and creates the brand files. Two years later she leaves. On AT Protocol those records live in her repo, under her DID, on her server. She owns them because the protocol gives her ownership of what she writes. That is the model working as designed on a case it was not built for.

The workarounds all fail in a familiar way.

• You can share one company account and pass the password around.
• You can copy everything into a vendor database and lose portability.
• You can ask people to hand over repos when they leave.

Every company that used Google Docs, GitHub, or Frame.io faced the same question. Who owns this after the person who made it is gone? Those products answer with an organization account and an admin who can transfer things.

What Spaces changed

The Spaces alpha added permissioned records to AT Protocol. A space is a set of records that live in the members' own repos. Only a credential from the space authority can read them. A group can share data without publishing it to the world.

The space authority is a DID. Nothing says that DID must be a person.

The same server with a different owner

The organization is the space authority. The organization runs its own data server, holds the space, and owns the tree. People still write into their own repos. The organization keeps the result. Nobody gives up a personal account. Nobody's departure takes the files away.

We model a project as a filesystem, not a bare record list. Teams already know paths, content hashes, a working tree, local edits, and a publish step. If you used git, you already know the shape.

We almost coined a new acronym. We did not. The letter that changes is who owns the server, not what it holds. We call it an Organization Data Server. A company needs the same portable server with the company's name on the deed.

What this does not fix

Spaces control access. They do not provide confidentiality. Every member of a space can read the contents. Every server that stores the space can read them too. Nothing is encrypted at rest. Do not put files here if a reader with access can hurt you.

The protocol feature and our product are alpha. Most AT Protocol accounts cannot join a space yet. The server behind the handle must support Spaces.

Hosting is only honest if an organization can leave. A did:plc moves only with a rotation key. The organization must hold a rotation key we do not control. We are not finished building that. We say so now rather than imply otherwise.

Try it

Open the product tree on this deployment at the product share link. Pick a display name. Get a guest identity. Pull, edit, and publish with no account and no PDS.

CAUTION: The demo is world-readable and world-editable.

If the model is wrong, two minutes of use will show it.