FamilySafe is only worth something if a determined fifteen-year-old cannot undo it in an afternoon. Three rules do that work, and each one closes the hole the other two would leave.
One. A module is sold against a machine, not to a person. A rating change can only be bought from an A or U machine, and only for a serial number registered to an account the buyer pays for. You cannot buy an A module for a laptop that is not yours, and you cannot buy one from the K machine you are sitting at.
Two. An account can carry a cap of its own. The payer chooses a level the account may not exceed, and chooses it when they create the account — one field, at the moment they are already deciding who this account is for. Making an account for a nine-year-old and making one for yourself are different acts, and the cap is where that difference is recorded.
It is set there rather than worked out later from the machine, because a machine is a guess about a person and the payer is not guessing. An account with no cap is the ordinary case: that is what you get when you make an account for yourself. Raising a cap afterwards is a deliberate act; lowering one is free and takes no purchase, because a stricter account harms nobody.
Three. A capped account cannot become its own payer. That is the whole lock. Only a payer can lift a cap, and a capped account cannot become one, so the only person who can raise a child’s level is the person paying for the child’s account. There is no sequence of steps that gets from one to the other.
So a capped account can sign in anywhere. Any Bolt, on any plan, in any house. The machine runs at the capped level for the length of that session: same filtering, same volume limit, whatever the plate on the underside says. A child can use a grandparent’s laptop, the other parent’s laptop, a machine at the library, and it behaves as their own machine does.
We tried the stricter version first, where a capped account simply could not sign in above its level, and it was worse in every way that matters. It made ordinary family life awkward, it needed a mechanism for households to name each other’s machines, and it bought nothing: a machine only runs capped while the capped account is the one using it, so nobody else is affected.
Lifting a cap for an evening. Settings has a one-press lift with a length on it: an hour, an evening, a day. It ends by itself. That exists because the alternative is a parent raising the cap properly, meaning to put it back, and not putting it back — a permanent change made for a temporary reason is the commonest way a protection quietly disappears.
Two things it does not do, and the screen says both before you press it. It applies to higher-rated machines on your own plan, not to anybody else’s. And it does not touch the hardware rating: a K machine is a K machine for the whole hour, and no lift makes it behave like an A machine. The lift raises what an account is allowed; it cannot raise what a machine is.
A cap ends when the account leaves the plan. A payer can release an account, and a released account has no cap: at that point there is nobody setting one. That is the path for a child who has grown up, and it is the same path a school uses when a student leaves. Nobody is trapped — but the release is the payer’s to make, which is the point.
Recovery codes restore access and nothing else. They get you back into your own account after a forgotten password. They do not change who pays for it and they do not lift a cap, so writing your codes down carefully is not a way around any of this.
The cap is enforced where the computing is. The machine does not report its own rating and get believed. The data center holds the rating on file for that serial number and the cap on the account, and applies whichever is stricter. So a module swapped without a purchase record changes what the plate says and nothing else.
A machine cannot be quietly re-registered. A Bolt registered to an account somebody else pays for stays registered until that payer releases it. Otherwise the whole thing unravels in four steps: make an account on a friend’s machine, become your own payer, re-register your own laptop to it, buy the module. Every step legal, the result absurd. The release is also how you hand a Bolt on when you sell it.
What none of this stops. A teenager with their own money can buy a second-hand A-rated Bolt and make an account on it, and nothing here prevents that. It is the same barrier as buying any other computer, and we would rather say so than pretend to a completeness we do not have. What these rules cover is the machine you bought and the account you pay for.