Ridgeback — security, permissions and who may change them

Access is one account standing in more than one house, holding a different set of groups in each. This board is the management surface for that: where a household edits its groups, where a person reads what they hold everywhere, how a guest is let in with an end date already attached, what a single thread may narrow on its own, what crosses when a thread is shared into a second house, and where the guardrail agent sits once the door check has already said yes. The three panels underneath are the spec — the order the four gates are asked in, the two passes the guardrail runs, the objects the model keeps, and the ten rules closed in the model rather than in the interface. Change a group in step three or a seat in step four and every frame to the right recomputes.

Access v0.2 · mobile

2026-09-10
neutral handset · 390 × 844
high fidelity
Maintained by Not Hotdog LLC

  1. 01Security and access
  2. 02People and groups
  3. 03A group, opened
  4. 04One person, two houses
  5. 05Inviting a guest
  6. 06The guest’s own seat
  7. 07Devices and the record
  8. 08What one thread narrows
  9. 09Sharing it into another house
  10. 10The guardrail agent
  11. 11What it looks like when it fires

01Security and access

One screen holds everything that decides an answer, split by what it is attached to. The top three rows change with the house you are standing in. The bottom two belong to the account and follow you into every house you are in.

02People and groups

The roster is people first and groups second, because a household thinks in names. Every row states the groups the person holds and the number of capabilities those groups add up to — a union, never a maximum. Theo holds two groups and one of them carries the flag, so his row says so in front of everyone.

03A group, opened

Board control · which group

A group is a name, a safety flag and a set of grants. Tap the grants and the members underneath recount. Turn the flag on and the two outward grants stay lit and stop firing — struck through rather than removed, because the group really does hold them and the flag really does withhold them.

04One person, two houses

Board control · whose card

Ray is a guest here and the Creator of The Rowan House, and this screen will not tell you the second thing. Dana is looking at a membership, not at a person — add and remove his groups and the card recounts, and the second house stays a name she already knew because she is in it too.

05Inviting a guest

An end date is a field on the form, not a thing to remember later. Pick a group and a length and the sentence underneath spells out the whole grant in plain words before the link is made. Until I remove them is available and is the only option that has to be chosen deliberately.

06The guest’s own seat

The same account, read from the inside. Every house it stands in, what it holds in each, and when the standing ends. Nothing here is editable except the last row, and that row is the one thing a guest can always do alone: leave.

07Devices and the record

Sessions are the account’s, so signing one out closes it in every house at once — the screen says which houses those are rather than making anyone work it out. Underneath sits the record of every change made to this account’s access, by name and by date, including the ones the account holder did not make and would not have chosen.

08What one thread narrows

Thread

A thread holds its own permissions, and every one of them subtracts. The pills the house already grants can be switched off for this room only; the ones the house withholds are drawn struck through and refuse the tap, because a thread that could switch them on would be a way to promote yourself by starting a conversation.

09Sharing it into another house

The thread does not move. The Rowan House is given a view of the object where it already lives, so Alder’s gates go on answering for Alder’s history and safe mode here cannot be walked around by routing the question through a second address. Act is drawn on the sheet and cannot be switched on, because a grant that has no legitimate use is clearer as a visible floor than as an absence.

10The guardrail agent

The gates are the bouncer at the door. The guardrail agent is the chaperone who walks in with you and stays for the conversation. It reads every request before the model does and every response before the thread does, and the two rows that say so are not switches — a guardrail with an off position is a setting, not a guardrail.

11What it looks like when it fires

An interception is a message like any other, and it names three things: what was withheld, which rule withheld it, and who in this house can lift it. Bobby keeps his own shape while doing it — no bubble, the answer on the page — because a refusal that arrives in a different voice reads as the system talking over him.

Spec · 5.8

How a request is answered

Four gates, each able to deny on its own, asked in a fixed order. Pick a person, a house, a room and an action and the panel runs them. The order is the specification — two arrangements of the same four checks give the same yes and no, and different reasons, and the reason is what the person actually reads.

Who is asking
Standing in
In which room
Asking to
What this house allows everyone

Why the flag is asked third and the grant fourth. Safe mode is checked before the capability check even though it is the later gate, because it is the answer that would hold even if the grant were given. Ask them the other way round and a child who was never granted the action is told he lacks permission, which is true today and stops being true the afternoon somebody grants it — and then the withholding arrives with no explanation attached.

Spec · 5.9

The guardrail agent, and why it runs twice

The four gates settle authorisation at the door and are finished before the model is called. Harm is usually not visible until the answer exists, so the guardrail runs a second time on the way out. Pick a person and a question and the panel runs both passes. A pass that changes nothing still ran — the panel says so rather than hiding the step, because a check you cannot see is a check nobody maintains.

Who is asking
What they ask Bobby
Rules this household has on

It can only narrow. The whole output vocabulary is five words, and none of them grants. A guardrail that could return allow anyway would be a privilege escalation path wearing a safety label — the one component in the product able to hand out what the gates refused, sitting in the one place nobody thinks to audit. So the gates own yes, and this owns everything smaller than the yes they gave.

  • AllowPasses through untouched. Still recorded as a pass that ran.
  • RedactRemoves a span and leaves a labelled slot where it was, so the reader can see that something is missing and ask for it.
  • WithholdHolds the whole answer and names who may release it. The question is not deleted and the asker is not accused of anything.
  • RefuseDeclines and gives the reason and the rule. Never a bare apology — a refusal without an author teaches the reader that the assistant is broken.
  • EscalateRoutes to a named person in this house and tells the asker who it went to and roughly when to expect them.
Spec · 5.1–5.10

The objects, and what is closed in the model

Twelve objects carry every access decision in the product. The column that matters is the last one: an object nobody can name a changer for is an object that will be changed by accident.

Every row is per household unless it says otherwise. “Structural” means the model refuses the edit rather than the screen hiding the control.
ObjectWhere it livesWhat it holdsWho may change it
Accountaccount Above every house A person, their sign-in, their sessions and their devices. One account stands in many houses and is the same account in all of them. The account holder only. No household admin can rename, lock or delete an account, in their house or anywhere else.
Householdhousehold Its own object A name, a set of groups, a set of memberships, and the house-wide tool switches that answer at gate 1. Creator, and Manager for everything but the house itself. Deleting the household is Creator only.
Groupgroup Inside one household A name, a set of grants and one safe-mode boolean. Two houses may hold groups with the same name; they are two objects. Anyone holding change groups. Never a member of a safe-mode group, and never a group that is itself flagged.
Grantgrant On a group One capability, switched on for that group. It is not ranked, weighted or scored, and it does not stack. Anyone holding change groups, except on the Creator group, whose grants are fixed at all of them.
Membershipmembership Person × household The set of groups one person holds in one house. A person’s capabilities are the union across that set, never the maximum. Anyone holding change groups, other than the person themselves. Nobody edits their own membership.
Watch grantsafe.view On one person, by name Permission to see records that relate to someone in a safe-mode group. Held per person on purpose, so it cannot be inherited in bulk. Anyone holding change groups. Creator holds it structurally and it cannot be turned off for them.
Invitationinvite Inside one household One group, one end date and one single-use link. It becomes a membership when accepted and nothing before that. Anyone holding invite people, and never to a group carrying more than the inviter holds.
Sessionsession On the account One signed-in device, its last activity and its location. A session is not scoped to a house, so ending it ends it everywhere. The account holder only. A household cannot sign one of its members out of their own phone.
Threadthread Inside one household A name, a member list, one Bobby mode, and a set of narrowings. A narrowing removes a capability inside this room; it cannot add one, so the thread set is always a subset of the household set. A member of the thread holding change threads. Being able to manage the house is not enough on its own — a private thread is not administered from outside itself.
Thread shareshare On the origin household One thread, one receiving household, where its history starts, and read with reply optional. There is no third level: no share carries the right to run a tool. Anyone in the origin house holding share a thread. Either house may end it, and neither can end it retroactively.
Guardrailguardrail On the household, house-side of the model Two passes that always run — one on the request, one on the response — and the rules they carry. It has no off position, and replacing the model does not replace it. Anyone holding change guardrails. Never a member of a safe-mode group, for the same reason such a group cannot hold change groups.
Guardrail ruleguardrail.rule On a guardrail, or on one thread A condition, one of five verdicts, and a scope. A thread may hold its own copy of a house rule, and that copy may only be stricter than the one it overrides. Anyone holding change guardrails, except the safe-mode rule, which is structural and has no editable verdict.