Access and ground rules
Cartmark sits behind a sign-in and knows who is looking. Each person sees their own household and their own things; the server's owner alone makes the decisions that belong to the owner; and a few rules hold whoever asks.
Live in 0.40.0.1The super admin since 0.31.1.19 · household admins since 0.31.1.30 · members confirm with their own sign-in password since 0.39
Who can see and do what
- The super admin, one account, makes the decisions that belong to the server's owner: turning on the use of firmware and keys, BIOS Approving a machine, making or removing admins, restoring a backup, switching virus scanning off, blocking an address for good, and running the households.
- Admins see and change everything else, and can always do the safe opposite of a super admin's act, so anything can be stopped at once. An admin confirms with their sign-in password; only the super admin keeps a second one.
- Household admins look after their own household: unlocking and resetting its members, inviting people, confirming a machine's hardware change, correcting who a game was credited to, restoring a member's save, and setting how long and how many loans its members may have. Households.
- Everyone else can browse the library, ask for a game within a request quota, download within a size allowance, borrow games to their machines within the household's loan limits, keep their own saves and achievements, and connect their own store accounts. They see their own household's machines and play, and nothing of another household's. They can't change settings, see store errors or touch another person's store accounts, and they confirm their own acts with the password they sign in with.
- Guests from another household play on a machine as themselves by scanning the code on its screen, and nothing of the household they visit is theirs to change.
The guides and About are open to every signed-in person; the rest follows the rules above.
A machine's player
Each machine has a player, who gets its saves and play time. On a PC, signing in to Windows makes you the player; switching to someone else needs their player PIN, and the tray asks it. A PIN is a person's own: an admin can clear a forgotten one but never read it. Who's playing.
The ground rules
What it always does
- Uses each store's own sign-in. Tokens and sign-in flows the store hands out, never a stored password.
- Leaves a trail. Every automatic action is logged.
- Shows its working. Every verdict says what it's based on.
- Asks the person. Nobody joins or leaves a household without saying yes, and every household admin act is in that household's History.
- Scans before it runs. No Windows game or installer reaches a machine before its virus scan.
What it never does
- Spend, claim or reveal on its own. That's your click, or an opt-in you switched on yourself.
- Claim anything not $0 at that exact moment.
- Guess. When the data's too thin to say something honestly, it says nothing.
- Let anyone act upward. A household admin acts only on ordinary members of their own household, never on an admin or on another household.
- Supply a game, a firmware or a key. It manages what you already have.