Vilice is a proof of concept. Run it on a box you can afford to lose.

vilice actors

List who may act on this box, at what scope.

observe not recorded — a read

vilice actors --help
vilice actors — List who may act on this box, at what scope

Reads the rights ledger back: every named actor, its scope, and its
key fingerprint.

It also reports any line in authorized_keys that Vilice did not
write. A hand-added key reaches the box without passing the gate, so
it is exactly the thing worth surfacing rather than skipping over.

Usage:
  vilice actors

Examples:
  See every key that can reach this box, and how far.
    vilice actors

Scope:  observe — reachable by any scoped key
Record: not recorded — this command reads, it does not act