01The flag
It lives on the group, beside the group's name, and it is the only switch on this screen. Flipping it writes one boolean — the panel underneath is what that boolean means, spelled out before anyone commits to it rather than after.
02What it withholds
Grant Kids the ability to spend money and watch what happens: the switch goes on, stays on, and the row underneath it says the action still will not fire. That is the entire design. A grant is what a group holds; the flag is what it may still do with it.
03Two groups, one person
Theo is in Kids and in Member, and Member grants send email and text. Take Member away and the count drops, put it back and it climbs, and the line underneath never moves: one safe-mode group anywhere in the list settles it, and the second group cannot hand back what the first withheld. Below that sits the other half of the feature, built the opposite way round.
04In the thread · gate 3
Theo holds send email and text through Member, and it still does not fire. The flag is the third of four gates and is deliberately asked before the grant check, because it is the answer that would hold even if the grant were given. Bobby names it, says it is the flag rather than a shortage of permission, and ends on who can lift it.
05The same screen, Theo's seat
Step one again, from inside the group. Everything is legible and nothing is editable, which is the point: a person under the flag is entitled to read exactly what has been done to them and cannot be the one to undo it. Tap anything here and it answers.
06The guest's seat
Ray was invited in and holds every grant The Aunties hold, which opens the calendar, the photos, the threads and the lists. The records that relate to Theo are simply not among them. Switch the seat to Mimi, who is in the same group with the switch turned on, and the same screen fills in.