A supervised teenager is the most motivated red team on earth

A supervised teenager is not a passive user. That is obvious said plainly, and many systems still forget it.

A teen has agency and technical curiosity, knows the social context, and has a far more personal stake in the system than the people designing it. If there is a bypass, they may find it. If devices behave inconsistently, they will notice. If the product tells the parent one thing and behaves differently for them, they will feel the unfairness immediately. That makes this work more adversarial than ordinary product design.

But I do not want us to treat the teenager as the enemy. That distinction matters more than it sounds. We have to design against bypass without designing with contempt — enforce a rule without turning the product into a punishment machine, respect a parent's real need for boundaries while remembering the teen is a user with dignity.

The family is not a security model, even though it contains security problems.

A security model wants clean authority: owner, admin, managed user, policy, enforcement. Families do not work that way. They have trust, conflict, negotiation, dependence, and exceptions that are emotionally obvious and hard to encode. The product lives between those worlds. If bedtime locking is a rule, it has to be real. If supervision exists, it has to be consistent enough that a parent is not misled. But emergency calls must always work. The teen must know what is happening. Supervision must never be silent.

This is why the edge cases matter so much. An edge case here is not a rare state transition. It is where the product reveals what it believes — whether it prioritizes control over safety, convenience over autonomy, a parent's reassurance over a teen's dignity, or enforcement over an escape in a genuinely dangerous home. The hardest problems in this space are not hard because the code is impossible. They are hard because the right answer is not one-sided, and the product has to choose anyway.