Every encrypted value in CoFHE is guarded by this contract. A handle is useless to anyone the ACL does not list. The TaskManager rejects operations on inputs the caller cannot access, and Teecryptor refuses to decrypt handles without a matching grant.
Grant tiers
Writes go through the TaskManager
All state-mutating entry points requiremsg.sender to be the TaskManager; direct calls revert with DirectAllowForbidden. Contracts grant access through the FHE.sol helpers (allow, allowThis, allowSender, allowGlobal, allowTransient), which route through the TaskManager.
Permits
Offchain reads are authorized by a permit, which onchain is anACP (Access Control Permission): an EIP-712 body signed by its issuer. Beyond the issuer, expiration, and the sealing key used for sealed outputs, an ACP carries a scope: global, limited to specific contracts, or limited to specific handles. A scope only narrows what the issuer could already access; it never grants more.
An ACP can be shared with a recipient, revoked through a revoker contract, and handed over onchain through the ACP share registry.
Read surface
The last two are what the decryption path runs on. For every
decrypt or sealoutput request, Teecryptor queries the ACL through the TaskManager: isAllowedWithPermission when a permit is attached, or isPubliclyAllowed (the TaskManager’s wrapper over globalAllowed) when none is. A future Threshold Network will consume the same interface.