At a Glance
Share access with ease
— chooses role, shares, manages access
Access share account with ease
— accepts invite, uses guest mode, ability to manage their own device
The Problem
The ecosystem assumed a single owner per device. To share care, people shared their full login — payment and subscriptions included. The UI supported one login for the entire ecosystem, and nothing else. Three things broke:
Top Pain Points
1
Insecure sharing hurt trust
The ecosystem was growing, but the single-owner account model wasn't built to scale.
Trust
Doesn't scale
2
A privacy & security risk
Password sharing exposed payment, subscriptions, and personal data.
Privacy
Security
3
A fragmented experience
Housemates couldn't set their own notification preferences — one login, one set of settings.
One-size-fits-all
Low control
The Reframe
How might we let households share pet care — invites, roles, and device control — without sharing a password or exposing payment and subscription data?
The reframe, as a question
The whole design hinged on two questions: who, and how much.
Access sharing comes down to who an owner wants to share with and what level of access to give. A survey surfaced two groups whose motivations, risks, and tasks were fundamentally different — and shaped the permission model.
Friends / Pet Sitters
Ongoing care → need full control & insights.
“I wish I could open the app and check the device status before I get to their home.”
Multi-User Households
Ongoing care → need full control & insights.
“I wish I could have different notification settings than my spouse — we care about different things.”
Two users, two jobs: the sitter wants a glance; the household wants a hand on the controls.
Challenge
Security Constraints
Sensitive account and billing data must remain accessible only to the primary owner. Shared access must enforce clear, safe, and predictable permission boundaries.
Technical Constraints
The existing platform was not built for multi-user authentication or granular device control. Introducing multiple roles affects mobile, backend, and firmware systems simultaneously.
Product Constraints
The solution must be simple to adopt, low-friction to ship, and scalable for future devices and experiences.
The Call I Made
Two roles, not ten — and a hard line around money.
Roles touch mobile, backend, and firmware at once, and the platform was never built for multi-user auth. So the model had to be simple to adopt, low-friction to ship, and safe by default.
The call — scope
A two-level permission model — Guest (Limited) and Full — with an audit of every screen to set shared vs. owner-only.
Instead of
Granular, per-feature permissions — flexible, but complex to ship across three systems and confusing to set up.
What it cost
Fewer dials for power users. But it's simple to adopt and safe by default — and payment & subscription data is never shared, at any level.
Who I brought
Legal, CX, and backend/firmware — the roles affected all of them; I aligned everyone on one set of access boundaries.
What each role can — and can't — do
Limited · Friends & Pet Sitters
Device status & history
Device control
Pet profile (view)
Urgent / error notifications only
No settings, pet edits, or account & shop
Full · Multi-User Households
Device status & history
Device control
Full insights & activity
Pet profile
All notifications
No payment / subscription info
Design Approach & Strategy
Invite in seconds. Control what they see.
The owner chooses a role, shares an invite, and manages access from one place. The invitee accepts, uses guest mode, and can still manage their own devices.
0
0
0
0
May2,025
May2,025
The work didn't end at my nine screens.
This flow was never just one product's. It's the pattern every new Whisker device now starts from — instead of inheriting the broken one.
A reusable role model
Guest + Full became the baseline for multi-user access across Whisker — new devices inherit it instead of reinventing it.
Boundaries across systems
Feeder-Robot and future devices adopt the same flow and recovery path, so the work compounds.
Guest mode
A reusable low-trust state — visibility without control — usable anywhere occasional access is needed.
A safety line
Payment and subscription data is owner-only by design — the default every future feature starts from.
The household got a team. The account kept its secrets.
Takeaway
Three things I'd change.
Expose the work early. This spanned Legal, CX, and three engineering systems — the sooner I put rough flows in front of all of them, the faster the boundaries got clear. Brainstorm and get it critiqued by as many people as you can.
Constraints first, dials later. Starting from “two roles, safe by default” shipped something real; the granular controls can follow once adoption proves the need.
EST. 2025
2:06:12 UTC