Feature 6
Organizer revoke
Production kill switch without the owner’s daily key.
Live /organizer-revoke/ + optional key at create
About this feature
Why it matters
Merch runs, festivals, and mutual-aid batches need an organizer who can disable bad prints without every volunteer holding owner keys.
Design decisions
Separate organizer key pair registered at card create; signs revocations with organizer_revoked reason. Distinct from owner revoke - explicit handoff UI on /created/.
Safety · privacy · security
Organizer key is powerful - treat like a production secret. Same signature + nonce rules as owner revoke. Not DRM: URL remains scannable; status changes to revoked.
Limits
No fine-grained ACL yet - organizer can revoke card or QR credentials they were registered for.
Future directions
Scoped organizer permissions, time-bound organizer keys, audit log for batch operations.