Notifications must name the source account

What it is

Pushes, system notifications, and in-app bells share one channel when several accounts are signed in. Labeling the source account means each notification carries a recognizable account name or badge, and a tap opens that account’s context—not whichever account happens to be in the foreground. This entry is identity at the notification layer. It is not about how the top bar shows the current account, and not about whether drafts clear on switch.

Why it happens

The OS typically gives one notification channel per app. If multi-account payloads omit an account id, the tap lands on the default account and people reply, mark read, or pay as the wrong identity. If the preview body contains another account’s client name, the lock screen leaks. People decide which row to tap by recognition; without a source label they guess. When the foreground account and the notification’s account disagree, the product must switch before showing, or the reply goes wrong. A badge that sums every account without saying so forces people to reconcile in the switcher one by one.

Studying it

Deliver one notification to each of two accounts, compare source labels and whether a tap switches to the owning account, and see where the reply is sent.

Independent variables: account name in the title, whether tap switches context, badge per account versus a sum. Dependent variables: tap into the correct account, replies sent as the wrong account, lock-screen previews that leak the other account’s content.

Lab notifications are triggered by the facilitator, so people are alert. The field should bury them among other apps. Open rate is not success—check the current account after open.

Where it stops holding

When the system forbids custom notification layout, at least put a short account name in the title. Do not force an “Account:” prefix on single-account users. Mail-like notifications are content in the body; they still need a source label so a work message does not preview on the personal account. After signing out of an account, its notifications must stop, or even a perfect label is pushing to a departed identity.

Applying it

• Every push and bell row carries a short account name or color badge; a tap switches to that account before opening the object.
• Lock-screen previews should not show another account’s body, or preview permission should be set per account.
• Badges may be per account; if the OS allows only one number, group by account once opened.
• Verify: with A in the foreground, tapping B’s notification makes B current and sends the reply as B. A lock-screen screenshot should not show A’s client body on B’s notification. After signing out of B, B’s pushes stop.

Related

• Within the group: H6.13.1 Account switching must show which identity is current · H6.13.2 Switching must not leave the previous account's sensitive state · H6.13.4 Isolation boundaries between coexisting accounts must be explicit
• Adjacent: H5.06 Actionable notifications · H6.06 Multi-device sessions
• Search terms: notification account label · multi-account push · wrong-account reply