Remote disposition of shared household devices must separate account from device ownership
Aliases: family sharing · device ownership · household device disposition
What it is
Shared household devices (tablets, TVs, speakers) pose a structural problem single-user devices never meet: one device hosts several accounts, and the device's owner is not the accounts' owners. A wipe request may come from a spouse, a child, or a parent — account disposition rights and device disposition rights must be modelled separately, otherwise one person wipes the whole family's data, or a device that must be wiped has nobody authorized to wipe it.
Why it happens
The single-user model needs one relation, "my device"; the shared household needs two tables: device ownership (whose admin) and account residency (which accounts have signed in). Which table a disposition action lands on sets the blast radius — wiping the device touches every resident account (the child's progress, the grandparent's photos), removing one account touches only its own. Households layer trust heterogeneity on top: the same device should grant adults, children and guests different disposition rights. When a system offers only "device owner may wipe," household reality — the device is the kid's, the account is the father's — pushes families into sharing passwords, degrading an authorization problem into a credential-sharing problem that is harder to clean up than the original.
Where it stops holding
Household structure itself changes — divorce, children coming of age, a death in the family — so disposition rights must track the changing structure, or the system deadlocks on "the ex-partner is still the admin"; end-of-life disposition (account inheritance, device handover) is the extreme test of the ownership model. Cross-platform capability is uneven: some family groups share payments but not device-level disposition, so designs cannot assume the full set. And in real households the device admin and the paying account holder are often different people — documentation that conflates the two labels manufactures permission disputes directly.
Applying it
- Fix two entries in settings with distinct rights: "remove my account" (available to any resident, touches only their data) and "erase device" (admin only, with a second confirmation).
- The erase confirmation lists every resident account about to be cleared — the admin sees the blast radius, not just a button.
- Ownership must be transferable: after a household change the admin can hand over device ownership, and the handover notifies the previous admin.
- Verification: a three-person household test executing both operation classes and checking blast radii against the two-table model, including the negative case "non-admin wipe attempt refused"; the permission matrix must match the model cell by cell.