Operations

Enrollment¶

Enrollment is physical, and it is the primary path — not a fallback. It happens in person, at a staffed checkpoint, against an institutional ID. There is no remote or self-service way onto the network. This is the mechanism that makes Zajil accountable rather than anonymous.

Why physical is the right default at institution scale¶

A university already runs exactly this operation every term — ID cards, badge activation, registration desks. Pushing ~10k people through staffed checkpoints is not unusual; it is routine. And because the drill runs continuously (see depletion), emergency recovery stops being a special operation nobody has rehearsed — it is muscle memory.

Three properties fall out for free:

Identity binds to a person

The checkpoint checks a student/staff ID. A roster entry is now a device and a verified human — which is what "know who is sending what" actually requires. No remote enrollment gives you that.
Deprovisioning is automatic

Credentials must be renewed in person. Someone who stops showing up falls off the network on their own. Graduates and leavers require no offboarding process — expiry does the work. See depletion.
A rehearsed recovery path

Because enrollment runs all the time, the staff, the procedure, and the equipment for a manual re-key already exist. The usual reason manual recovery fails — nobody has ever done it — does not apply.

Checkpoints hold no key material¶

This is the critical security property. If a checkpoint could issue identities, its device would be the softest target in the system — compromise a folding table in a hallway and you can enroll yourself.

Instead:

graph LR
    ROOT["🔑 Root key<br/>(offline)"] -->|pre-generates,<br/>signs, prints| TOK["🎟️ Enrollment tokens<br/>serialized, sealed"]
    TOK -->|handed out at| DESK["🏫 Checkpoint<br/>(holds NO key)"]
    DESK -->|activates one slot| ROSTER["📋 Roster"]

    style ROOT fill:#c1121f,color:#fff,stroke:#8c0c16
    style DESK fill:#f5f5f5,color:#111,stroke:#e4e4e7

The operator pre-generates single-use enrollment tokens offline, under the root key, and prints them.
The checkpoint hands out sealed envelopes and records which serial went to which ID.
A token activates exactly one pre-existing roster slot, once.

Checkpoints activate slots; they never create them

Enrollment tokens are pre-generated offline under the root key. The roster already contains every slot — enrollment just flips one to active. The roster stays a single-writer artifact the operator holds.

What a compromised checkpoint gets you¶

A stack of paper. You know precisely which serials were taken, so you void that range and reprint. No key material was ever there, nothing needs re-keying, and the blast radius is one envelope box. It also sidesteps a roster-merge problem: no dynamic enrollment means no many-writer reconciliation.

The exception path¶

Some people genuinely cannot reach a checkpoint — distance students, staff abroad. The policy is deliberately simple: someone is sent to them in person. It stays a physical handoff. An undefined exception path is where every strict enrollment scheme actually leaks, so it is named rather than improvised.

The academic-calendar gap that worries other institutions does not apply here — this is a year-round program, summers included.

Full physical trust, by design¶

The goal is a network that cannot be joined casually or remotely, so it cannot quietly become infrastructure for what it should not carry. Every door is a desk; every desk checks an ID. Combined with accountability by attribution, this is the halal-by-construction posture: encrypted for its members, closed to misuse, owned end to end.