Access windows and grants
The three kinds of access that last for a while instead of one ask at a time, who sets each one, how long it can run, and what ends it.
Most of the time, every use is one ask and one answer. Three things last longer, on purpose, and each one ends by itself.
The three, side by side
| Your vault open on the phone | A laptop’s trust window | A grant | |
|---|---|---|---|
| What it allows | Easy things open on that phone without a step | Easy logins fill on one laptop without asking | One computer’s programs get the secrets you gave |
| Which things | Easy only | Easy only | any level you gave (not Two devices yet) |
| Set where | Settings → App lock → Keep my vault open for | when you pair, or in Devices | on the ask, when you tap Give |
| How long | 10 minutes (or 30 minutes, 1 hour) after you unlock | until tonight, at most 8 hours | Once, 1 hour, 8 hours, 1 day or Custom, up to the level’s limit |
| End it early | Lock now | End trust now in the popup | Revoke on the phone, or vando grants end |
Your vault open on the phone
When you unlock your phone, your vault stays open on it for a short while, so Easy things open without asking again. The phone’s own security chip keeps the time; Vando can’t stretch it. Lock now closes it at once. Easy.
A laptop’s trust window
A trust window lets Easy logins fill on one laptop without a phone tap, for an evening of work. It ends at the time shown when you started it (by 11 pm, and never more than 8 hours), and it never renews itself. Anything above Easy still asks your phone, and if the extension sees signs that an AI is driving the browser, every fill asks. Your laptop and Chrome.
Grants
A grant is what your phone gives a program when you tap Give on an ask from vando run: the secrets on the screen, for the time you picked, for one computer.
- Your phone sets the end. It works out the end time from its own clock and signs it. Vando’s server holds the grant locked to that computer’s key: it can’t read it, swap it or make it last longer.
- The computer checks it. Before each run,
vandochecks your phone’s signature and the end time by its own clock. - Once means one run. Every other choice covers every run that asks for the same secrets until the end time, with nothing to tap.
- The level sets the limit: Easy up to 7 days, Just me up to 1 day, Fort Knox up to 8 hours (and Fort Knox starts on Once). Levels and programs.
You see every live grant in two places: vando grants on the computer, and Connections → Claude Code → Can use now on your phone, with how often each was used. Ended grants stay in the log, under What it was given.
What ends a grant
- Its time runs out, or a Once grant is used.
- You Revoke it on your phone, tap End everything, or run
vando grants endorvando logouton the computer. - You change the lock of a secret in it, or move one to the Trash.
- You disconnect that computer, your account goes into a recovery, or it is being deleted.
- It is used far too often: Vando stops it and tells you.
Programs already running
A grant ending stops the next run. A program that is already running keeps what it read, until it exits. Two ways to stop it:
- Revoke on your phone with Also stop programs it started on (the default):
vandostops the program it started at its next check (once a minute). - Start the program with
vando run --stop-at-end: it is stopped when the grant’s time runs out.
What a grant can’t promise
- While a grant is live, anything running as you on that computer can use it: your scripts, your AI, another program. Shorter is safer. More.
- Ending is not taking back. A program or an AI that already read a secret keeps it. Change the secret where you got it if that matters. More.
- Revoke relies on Vando’s server; the end time doesn’t. A server that lied could keep serving a revoked grant until its end time. It still couldn’t read the secrets or make the grant last longer.
Last verified