Make it hard to reverse alone.

1. Complete iPhone / iPad Guardrails.
2. Have the trusted person set the Screen Time passcode.
3. Set Web Content to Limit Adult Websites or Only Approved Websites.
4. Set Installing Apps, Deleting Apps, and, under Allow Changes To, Passcode & Face ID, Accounts and Cellular Data to Don't Allow.
5. Remove unneeded browsers, VPN apps, proxy apps, and alternate app stores.
6. Do not store the Apple Account password in iCloud Keychain or Notes if you can use it to undo the setup.
7. When iOS prompts for Screen Time Passcode Recovery as the passcode is set, enter the trusted person's Apple Account. Never the account whose password you know, and do not skip the prompt: skipping removes the only supported recovery route, so a forgotten passcode means erasing the device.
8. If the passcode is already set, have the trusted person change it and answer that prompt correctly this time. There is no way to audit the stored recovery account after the fact.
9. Add router or DNS filtering so Safari is not the only layer.

A factory reset or recovery-mode restore erases Screen Time entirely, and reactivation only asks for the Apple Account password you already know. On an unsupervised iPhone that path stays open to you permanently. Supervision through Automated Device Enrollment, which re-enrolls the device after an erase, is the only way to close it.

1. Use this only if you are comfortable with Apple Configurator, MDM, or a managed-device workflow.
2. Manual supervision with Apple Configurator erases the device; back up first.
3. Use a DNS settings payload, web content filter payload, app restrictions, and profile restrictions through MDM where appropriate.
4. Have the trusted person own the MDM admin account.
5. Test whether the user can remove the profile, install a browser, add a VPN, change DNS, or reset the device.

Do not supervise or enroll a device you do not own or administer.

1. Complete Android Guardrails.
2. Have the trusted person own the parent side of Family Link, where the daily user's account is eligible for supervision.
3. Keep the parent Google password off the managed phone.
4. Require approval for app installs and purchases.
5. Remove extra browsers, VPNs, proxy apps, private browsers, and alternate app stores.
6. Set Private DNS to the family-safe hostname from Android Friction.
7. Test on Wi-Fi and mobile data.
8. Have the trusted person hold the parent account's password and backup codes. See the caution below before moving recovery email or phone numbers on your own everyday account.

1. If the phone is rooted, assume local filters and hosts files are reversible.
2. Remove root if possible before relying on Family Link or Private DNS.
3. Disable OEM unlocking and developer options if they are not needed.
4. Use a router or DNS account controlled by the trusted person.
5. Use a carrier or account-level solution if mobile data is the bypass.

1. Complete Chromebook Guardrails.
2. Use the trusted person's account as the owner account when practical.
3. Turn off guest browsing.
4. Restrict sign-in to approved accounts only.
5. Use Family Link on the daily account, subject to the age limit described under Android lockout.
6. Remove or block proxy, VPN, remote desktop, and alternate-browser extensions.
7. Do not leave the owner password available to the daily user.

1. Use Chrome Enterprise, school management, or another legitimate managed-device setup when personal settings are not enough.
2. Restrict guest mode, unmanaged sign-in, extensions, developer mode, and URL access.
3. Use URL allowlists for the hardest setup.
4. Have the trusted person or organization own the admin console.
5. Test after powerwash or account removal attempts if your policy model permits those tests.

1. Complete Windows Guardrails.
2. Create or keep one administrator account for maintenance.
3. Create a separate standard account for daily use.
4. Move all daily browsing, work, and entertainment into the standard account.
5. Have the trusted person change and keep the administrator password.
6. Put the daily account in a Microsoft family group as a member, with the trusted person as organizer. Only the organizer can change a member's filters, and a member cannot leave on their own. See Windows Guardrails.
7. Remove admin rights from the daily account.
8. Keep Microsoft Family Safety active if you use a managed Microsoft account.
9. Use Edge if you rely on Microsoft Family Safety web filtering.

1. Use browser policy from Windows Friction to disable browser DNS-over-HTTPS.
2. Use AppLocker or App Control for Business, formerly Windows Defender Application Control. AppLocker now enforces on every edition of Windows 11 including Home, which makes it a hazard there rather than an exemption, since Home has no policy editor to undo a bad rule.
3. Start application-control rules in audit mode.
4. Block portable browsers, VPN clients, proxy tools, unapproved installers, and user-writable executable paths.
5. Keep the rule-changing administrator account with the trusted person.
6. Test from the standard account after every rule change.

1. Turn on device encryption. It is available on every edition of Windows, and recent versions dropped the old hardware requirements. Protection only arms when an administrator signs in with a Microsoft account: until then the drive is encrypted but the key is left unprotected. Have the trusted person's admin account do that sign-in, which also escrows the recovery key to their Microsoft account, and confirm encryption is actually on.
2. Store the BitLocker recovery key with the trusted person, not in a place the daily user controls.
3. Check aka.ms/myrecoverykey from the daily user's Microsoft account. Windows escrows the key to the account of whichever administrator armed encryption, so the copy should sit with the trusted person, not the daily user; if one is there, remove it.
4. Remove or rotate any escrowed copy the daily user can still reach, or accept that BitLocker is not part of your lockout.
5. Use Secure Boot where supported.
6. Use a UEFI or firmware administrator password only if you understand how to recover it for your device model.
7. Prevent booting from USB or external drives if your firmware supports that policy.
8. Close the sign-in-screen reset. Holding Shift while choosing Restart, then Troubleshoot -> Reset this PC -> Remove everything, asks for no password by default and, with the default TPM-only encryption, no recovery key either, so a standard user can wipe to a fresh install where they are the administrator. Set the RecoveryEnvironmentAuthentication policy to require a sign-in (Pro and Enterprise, via policy or registry), or use TPM plus a startup PIN, alongside the firmware password and USB-boot lock. Then verify by attempting it from the daily account.
9. Keep purchase receipts and OEM recovery information with the trusted person.

Firmware passwords and encryption recovery keys can create real lockouts. Store them carefully with someone reliable, and keep a second copy somewhere the daily user cannot reach but that does not depend on one person staying reachable. See the redundancy rule.

Handing over the recovery key limits offline and external-boot tampering. It does not stop normal use: the daily user's own Windows sign-in still unlocks the drive.

1. Complete Mac Guardrails.
2. Create a standard account for daily use.
3. Keep one separate administrator account for maintenance.
4. Have the trusted person change and hold the administrator password.
5. Use Screen Time with the trusted person holding the Screen Time passcode.
6. Remove extra browsers, VPN apps, proxy tools, and unneeded installers.
7. Use DNS or browser policy from Mac Friction.

1. Turn on FileVault if appropriate for your Mac.
2. When macOS asks how you want to be able to unlock the disk, choose the recovery key option rather than iCloud account unlock. Letting your iCloud account unlock the disk leaves recovery in the hands of the person you are trying to restrain.
3. Store the FileVault recovery key outside the Mac and away from the daily user.
4. Have the trusted person enable FileVault from the administrator account. On macOS 26 the recovery key is saved to the iCloud Keychain of whoever turns it on and is readable in the Passwords app on every device signed into that Apple Account, so enabling it from the daily user's account hands them the key. Afterwards, check the Passwords app on the daily user's devices and confirm no copy is there.
5. Use startup security settings on supported Macs to reduce external-boot tampering.
6. On managed Macs, use MDM to enforce profiles, content filtering, app restrictions, and browser policy.
7. Keep MDM, local admin, and recovery-key control with the trusted person or organization.

Do not lose FileVault recovery. A strong lockout can also lock out legitimate recovery. If you forget both the login password and the recovery key, the data is gone for good, so keep the key in at least two places the daily user cannot reach. See the redundancy rule.

1. Create a non-sudo daily account.
2. Have the trusted person hold root, sudo, or admin credentials.
3. Configure DNS, hosts, firewall, and browser policy from Linux Friction from an admin account.
4. Use the daily account only for normal work.
5. Check that the daily account cannot edit /etc/hosts, change DNS, install browsers, start VPNs, or change firewall rules.

1. Use full-disk encryption if appropriate.
2. Store the encryption recovery passphrase with the trusted person.
3. Use firmware boot restrictions where supported and recoverable.
4. Block DNS at the router so the Linux machine is not the only layer.
5. Do not keep unencrypted backups of the admin credentials on the same device.

1. Set family-safe DNS on the router.
2. Block or redirect outbound DNS to other resolvers.
3. Block DNS-over-TLS unless it goes to your chosen resolver.
4. Handle IPv6 DNS.
5. Disable or filter guest networks.
6. Have the trusted person hold the router admin password.
7. Have the trusted person hold the DNS provider, NextDNS, CleanBrowsing, AdGuard, Pi-hole, or firewall admin password.
8. Store router recovery instructions with the trusted person.

• Mobile data.
• A neighbor's Wi-Fi or public Wi-Fi.
• A separate hotspot.
• A device using a VPN or browser DoH profile unless you also manage that device.
• A person with physical access who can reset the router and knows how to reconfigure it.