An analysis of Fraink's security, identity, and credentialing model from the official Trust page.

Key Management & Security

• One Key Per Person: Shared secrets are prohibited. Keys are displayed once at issuance; only a SHA-256 digest is stored.
• Universal LLM Integration: The same secure credential connects ChatGPT, Claude, or Grok.
• Public Exposure: Tokens are never placed in public discovery files like /llms.txt.

Zero-Trust Permission Mapping

Fraink rejects secondary permission databases, relying entirely on the brand's existing org chart:

• Franchisee: Restricted to one territory via their own key.
• Franchisor: Accesses every child site they already administer.
• Operator: Bound strictly to the sites they currently manage.
• Real-Time Enforcement: Token validity is checked on every request. Demotions take effect on the next API call.

Complete Accountability

• Attributed Actions: Every database write is logged to a specific human, never an anonymous bot.
• Human-in-the-Loop: Threads sit with the work in the management UI for human preview, approval, or rejection.