Build Log #04: I built something I could not let anyone use.

The short version: I wanted to give you a real login to the app I built, so I asked one question before I created any accounts. The answer was no, and the reason turned out to be the same thing that made the app possible in the first place.

Last week I told you about an improvement application I built out of nothing but Google products, the one I have been calling Plumb, and I finished by handing you a demo to click. What I said about that demo was one sentence long. I could not put the real one on the internet, because it runs on my own Google account. That was the compressed version. This is the whole of it.

When the app started working properly, the first thing I wanted was for somebody who was not me to use it. Not a screenshot and not a recording. The actual thing, with real sign-ins, because the entire argument of the last issue was that the sign-ins were real and the walls between people held. A picture of that proves nothing. You would have to be standing inside it.

So the obvious move was to make a couple of guest accounts and hand them out. Nothing with real reach, nothing that could break anything. A regional manager and a site manager, two of the limited roles, so you could sign in, poke around your slice of the organization, try to reach somebody else’s site, and watch the app refuse you. It felt like a small thing to set up. It would have taken me about 10 minutes.

I never made them. I stopped and asked whether it was safe first, and I want to be straight about what that was and what it was not. It was not expertise. I do not write code and I could not have told you what was wrong with the plan. What I had was a much duller instinct: handing strangers a login to something running on my own account was a decision I would not be able to take back, and things you cannot take back are worth checking before rather than after. So I took the plan back to PRISM, the AI build system I described last time, and asked it to read the app’s own code and tell me what a guest would actually be able to reach.

The answer came back in two parts, and the first one reframed the whole app for me.

These Google-built apps do not run as the person using them. They run as the person who built them. When a visitor clicks a button, the work happens with my permissions, not with theirs. That is not a setting I got wrong, it is how the thing works, and it is precisely what lets you build an app with no server, no database and no hosting bill. You are not renting infrastructure from anybody. You are lending the app your own account and letting it act as you.

Which means the question is no longer what a guest can do in the app. It is what my account can do. And by the time an app is doing real work, my account can do a great deal. This one creates documents, copies them, and clears them away, so it holds the keys to my whole Drive, not just its own corner of it. It sends email, so it can send mail from my domain to any address it is given. It can reach out to the wider internet. None of that is exotic. It is the ordinary cost of an app that actually does things. But a visitor clicking around inside it is a visitor standing in my account, with my reach.

The second part was worse, and it had nothing to do with the app at all. I built it on my own domain, and that is not a scratch domain I spun up for an experiment. It is my professional one, the address on my resume, the one I am job hunting from. An account there is not app access. It is a real identity inside my own organization. It shows up in the directory, people can share things to it, and mail leaves it looking like it came from me. Shared logins cannot carry two-factor sign-in properly either, and Google tends to lock accounts that several different strangers sign into from several different places, which would have taken the app down along with it.

There was a quieter problem underneath both of those. The app knows who you are by the Google address you signed in with, and nothing else. Share one guest login among a group of readers and every action in the record was performed by the same person. The audit trail, which is one of the things that makes it worth calling software instead of a spreadsheet, would have stopped meaning anything.

So the thing that made the app possible is the thing that made it unshareable. I could not open it up without opening myself up, and those were the same act.

What you clicked last week is therefore not the app. It is the app’s face with nothing behind it. I took the real screens, exactly as they are, and replaced the single place where the app talks to Google with a small piece of make believe that runs inside your browser instead. The organization in it does not exist. The people in it do not exist. The email addresses are from a range that is reserved for examples and cannot reach a real person. There is nothing to sign into because no account is involved anywhere, which is also why I could let you see the administrator view, the one I would never have handed out as a login.

That choice has a cost. The demo is a copy, so when I change the real app it does not change with it, and it will drift quietly out of date unless I remember to rebuild it. I would rather carry that than the alternative.

The part I keep turning over is that nothing here was a technical problem I solved. I did not fix anything. There was no incident, no scare, no cleanup. There was a plan that sounded reasonable, a 10 minute job I was about to do, and one question asked before instead of after. That is the whole story, and it is the least dramatic and most useful week I have had in a while.

Click through it yourself: https://rodneybuilds.com/plumb-demo

Have you ever built something useful and then found you had no safe way to show it to anyone? I would like to hear about it. Hit reply.