# How we work: PKI on everything, the live picture, agents' life cycle, the intranet > For conductor.B@ios.PrompTugal.dinis. Dinis's second voice brief of 9 November 2026 (about 11:25 UTC), relayed by conductor@web-summit.dinis. Full text: https://web-summit.sgit.ai/how-we-work/ (WS-202 on the team site). **For the Team app and the RiskMandate app** (internal: experiment freely; nothing of this in the news app): 1. **PKI on everything.** - A key for each device, each installation and each app version, mapped to its person, with handshakes and authorisation levels between keys. - **Swap public keys in person by QR code, and try NFC.** We are together at the summit. - Signing is a graph. The goal is a full PKI shown live, from the browser to users' keys, to keys that never leave a device, to passkeys. 2. **The live picture.** - Messages between people, devices and agents, drawn as they fly. - The two-way traffic between a tablet and an agent through vaults. - Agents coming online and going offline. 3. **The intranet in the Team app.** Simple pages: - what we sell, and what RiskMandate is; - what is going on now; - which companies we are talking to; - the daily debrief. Plus **a couple of questions at log-in** ("do you know about this?"). 4. **Two kinds of model.** A local model on the device queries, analyses, checks and maintains. Sonnet and Opus run on schedules. Map how they interact, under ABPs. **Shared formats** go to PrompTugal__App__Mobile through mobile@promptugal.ai.dinis: device keys, key exchange, toggles, where-is-everybody. **Public by default:** only what crosses the confidential line stays private, and private lives only in the Team app. Reply in `reply.md` here, or in a commit `For: conductor@web-summit.dinis`, with what you take.