Household members can hold unequal control over the same device

What it is

The same device wears different identities for different household members: the one who bought it, the one who installed it, the ones who use it daily, the child it governs, the elder it cares for. Control over a device is therefore naturally layered — who may operate it, who may change its settings, who may remove it. In practice the asymmetry is rarely a deliberate household arrangement but a by-product of system defaults: whoever completed setup first becomes the admin; everyone else's access rides on shared credentials or after-the-fact invites whose scope nobody can state.

Hence a widespread mismatch: control follows installation labour, not household intent. Whoever commissioned the network holds the keys — even after moving out, separating, or losing all interest in the device.

Why it happens

The root is a model mismatch: smart homes inherited the single-user account from phones. A phone is one person, one device; a home device is one household, many people. Port the single-user model onto a shared object, and "owner" can only be one individual — typically the first to install (often the most technical member).

That initial allocation then self-cements: only the admin can rename, remove, or change permissions. When other members hit a permission wall, the cheapest resolution is "go ask whoever manages the phones", not a system flow — the household routes around the design socially, and the design never gets the feedback that would fix it.

A third layer comes from a capability mismatch: admin rights demand configuration competence (where's the hub, how to open settings), while what families actually want to allocate is use and constraint (the child must not touch the lock; the tenant may only switch lights). The system never separates the two dimensions, so whoever can configure is forced to govern, and whoever cannot must ask permission even to use.

Studying it

• Security and privacy concern studies: Zeng, Mare and Roesner (SOUPS 2017) interviewed smart-home households and found a broad, unmet desire for access control — restricting children, granting cleaners limited entry — that existing systems barely provide, leaving households to share credentials or make do. Much of the "asymmetry" is thus demand without tooling.
• Access-control preference surveys: large-scale questionnaires presenting permission scenarios (parents/children/guests/helpers across device classes) yield the socially desired permission matrix; comparing it against actual product defaults maps the design gap.
• Who-controls vs. who-uses mapping: inventory each device's actual users versus its nominal controllers; the set difference (uses daily but has no rights; never touches but holds full rights) is the direct measure of asymmetry.

One methodological caution: family members contradicting each other on "who decides" is the norm, not noise — interview separately, then compare; the contradictions mark exactly where household permissions are sensitive, and where design needs explicit negotiation mechanisms.

Where it stops holding

• Asymmetry is sometimes exactly what the household wants. Parental controls, eldercare management (adult children managing medication reminders), landlord-retained entry — constraining asymmetry is a feature. The critique targets asymmetry that is unintended, unknown, and untransferable, not layering itself.
• Device form weakens enforcement. Screenless voice devices authenticate weakly (anyone in the room can speak); a permission system is only as strong as its least authenticated entry point — evaluate any permission scheme together with the auth reality of every channel.
• Single-person and shared-flat households differ sharply. The topic barely exists for single occupants; conclusions apply mainly to multi-generational homes, homes with minors, and homes with long-term hired help.

Applying it

• Create explicit roles (admin / member / restricted) at household creation, with a discoverable transfer path — changing admins should not require unbinding and rebuilding every device.
• Have the setup wizard ask "who else lives here?" at completion, folding invites into first-run instead of leaving them buried for later — pre-empting the silent-admin default.
• Attach a "who can control this" list to each device's settings page, making the current state inspectable — an invisible permission structure cannot be negotiated.
• How to check: a home audit comparing each device's permission structure against the household's stated intent — the mismatch rate is the metric; separately test whether admin transfer completes without touching the devices.

Related

• Same group: Z4.07.2 Over-fine permissions add friction to daily operation · Z4.07.3 Over-coarse permissions give secondary members unexpected power · Z4.07.4 Permission changes need to notify affected members
• Nearby: Z6.02 Permission layering · Z4.08 Guests and temporary access
• Search terms: household access control · smart home permissions · multi-user smart home