Over one session, I built Kid Compass — a calendar and chore planner designed so kids plan their own day, and parents can only watch, suggest, and cheer, never edit. It's a small, human idea wrapped around one of the trickiest authorization shapes in this whole series: a privacy boundary that holds even against the account that's paying for the app, managing the family, and has every other administrative power available.
Unlike the previous builds in this series, this one didn't start from a single spec-in-one-prompt. It started as a brainstorm — a long list of possible authorization-testing app ideas, narrowed down over a few rounds of conversation, before landing on a specific pedagogical goal: an app that promotes independence in kids, not surveillance of them. That shift in framing — from "parent controls the calendar" to "kid owns the calendar, parent is a guest" — is what produced the interesting access-control problem underneath it.
About Kid Compass
Kid Compass is a role-based family planner built around four types of users:
• Family Admin — the parent who set up the household
• Guardian — a co-parent with full standing access
• Secondary Guardian — a babysitter, grandparent, or coach with narrowly scoped access
• Child — the owner of their own day
Family Admins and Guardians can:
• See every child's schedule, chores, and tasks in the family
• Leave a suggestion (a comment or nudge) on any block or task
• Assign a chore to a specific child, or drop it into a shared pool for any kid to claim
• Set a reward on a chore
• Turn on "maturity mode" for a child, unlocking their ability to mark entries private
Secondary Guardians can:
• See only what an explicit, revocable grant allows — one child, optionally one kind of entry, optionally a bounded time window
Children can:
• Create, edit, and delete their own schedule blocks and tasks
• Mark an entry private, if maturity mode is on for them
• Claim an unclaimed chore from the family pool
• Mark their own tasks complete — and only their own
I wanted this one to have a different shape than "owner vs. everyone else" or "time-gated reveal," which I'd already built. Here the interesting boundary is: two people can hold the exact same role (two kids are both CHILD) and still need to be fully isolated from each other, and one field on a single database row can have two different owners depending on who's writing to it — the child owns the title, the parent owns the reward.
My Tech Stack
• Claude Code
• TypeScript
• Next.js (App Router)
• React
• Tailwind CSS
• Radix-based shadcn/ui components
• Clerk Authentication
• PostgreSQL
• Prisma ORM
• Neon Database
• Vercel
• PerfAI Security (free access control testing)
Same stack as the rest of the series, pinned to the same dependency versions as the earlier sibling apps for consistency.
Development Process
After settling on the concept, I used Claude Code to build the application in a single development session. The project included user authentication, role-based permissions, family management, dashboards for parents and children, scheduling features, chores, rewards, and a complete authorization system.
As with every project in this series, the first version wasn't the final version. I refined several authorization edge cases, improved the user experience, fixed UI inconsistencies, and prepared the application for security testing before considering the project complete.
The result was a fully functional application that demonstrates how modern AI development tools can dramatically accelerate building complex software while still requiring thoughtful review, iteration, and security validation.
Try Kid Compass
Kid Compass is live at kid-compass-teal.vercel.app. There's a live demo at /demo that drops you straight into a real family's week — activities, chores with rewards, a shared chore pool, and one entry that stays private even from the parents watching — no account needed to look around.
Security Check with PerfAI
Kid Compass manages sensitive family information, including children's schedules, private calendar entries, chores, rewards, and delegated guardian permissions. Applications like this require much more than simple authentication — they require carefully enforced authorization to ensure every user can only access the information they're supposed to see.
To validate these authorization rules, I reviewed the application using PerfAI Security, focusing on the areas most likely to expose sensitive family data.
The review evaluated questions such as:
• Can one child access another child's private schedule?
• Can a guardian modify information they're only supposed to view?
• Can delegated guardians access data outside their assigned permissions?
• Are private calendar entries properly protected?
• Are ownership checks enforced across every API request?
The review identified several authorization improvements involving delegated permissions, ownership validation, and response filtering. After implementing these recommendations, the application's authorization model became significantly stronger and better protected against common access-control vulnerabilities.
All I needed to do was type in my app's URL.
Final Takeaway
Kid Compass explored a different kind of authorization problem than the other applications in this series.
Instead of asking whether a user could access another person's resources based on role alone, the application required permissions to depend on family relationships, delegated access, ownership of individual pieces of data, and even ownership of specific fields within the same database record.
Claude Code accelerated the development process and helped build a complex permission model in a single session, while PerfAI Security helped validate the authorization boundaries that protect children's privacy and family data.
The combination of AI-assisted development and authorization testing produced a much stronger foundation before release and reinforced an important lesson from this series: the most difficult security problems usually aren't about authentication — they're about correctly enforcing who should be allowed to access what, under exactly which conditions.
App URL: https://kid-compass-teal.vercel.app
Top comments (1)
The authorization shape in Kid Compass, where two users with the same role can be fully isolated from each other, is particularly interesting and highlights the complexity of implementing proper access controls. I appreciate how you've used Clerk Authentication and PerfAI Security to handle authentication and access control testing, respectively. The use of a single database row with multiple owners, where the child owns the title and the parent owns the reward, is a great example of a nuanced access control scenario. Did you encounter any challenges when implementing the "maturity mode" feature, which allows children to mark entries private, and if so, how did you address them?