Traditional auth systems like OAuth depend on the network boundary to secure your data from prying eyes. We have no such luxury in local-first: your data can move between devices in any number of ways, and there is no process protecting who can access what. This requires a different approach to prevent unauthorised reads, control who can write, who can sync, and preventing backdated writes. At Ink & Switch, we developed Keyhive to provide an answer to these problems, suited to Automerge but general enough to work with other CRDTs too. Come find out how solving the hard problems of local-first access control maybe leads to even better security for all users.