The way gevulot works is by generating a tree of public and private key pairs: a new pair is generated whenever the user has a new memory, domain or experience they want to specify gevulot rights for. They are also encrypted with the pair above them in the hierarchy. The point is that only the individual is supposed to have access to the root.
