Managed Participants — Market, Pattern and Compliance Research

Ticket: TKN-382 Method: Four parallel research agents, primary sources only, headless Chromium where pages were bot-walled or client-rendered. Every claim carries a URL. Claims the agents could not verify are listed as unverified rather than inferred. Completeness caveat: all four agents were terminated by account rate limits (HTTP 429) before final consolidation. The findings below are what was verified and returned; named gaps are listed in §6. Nothing here is padded to look finished.

This is not legal advice. §4 is a mapped constraint list with citations for counsel to confirm.

1. The competitive finding that matters most

Boostapp already ships this feature, and it is the benchmark to beat — not Arbox, and not Mindbody.

From Boostapp’s own live marketing page (boostapp.co.il/ניהול-חוגים ):

«תמיכה מלאה בלקוחות שהם קטינים, אין צורך בכתובת מייל או במספר טלפון כדי לקלוט לקוח, ניתן בקלות לשייך לקוח קטין להורה שלו ואפילו לנהל מספר ילדים תחת אותו הורה. ההורה מקבל את כל העדכונים הרלוונטים בעבור הילד, כולל חתימה על הטפסים בשמו ותשלום.»

Full minor support, no email and no phone required, multiple children per parent, parent receives the child’s notifications, signs forms on their behalf, and pays. Their entity is named לקוח קטין (minor client), linked through a בלוק קשר משפחתי (family-relation block) to a לקוח משלם (paying client).

So “we support child accounts” is not a differentiator in this market. It is table stakes we currently fail.

Where Boostapp is weak — and these are the differentiators

Gap	Evidence
One guardian only. The model is 1 minor → 1 `לקוח משלם`, “one of the parents”. No second parent, no grandparent, no escort, no conflict handling.	`intercom.help/boostapp-site/he/articles/11836321` (help centre now 404s workspace-wide; quote from search index, corroborated by the live marketing page)
Guardian and payer are fused into one role. Cannot model grandmother-pays / mother-books.	ibid.
No age-derived minor status and no 18-year-old transition. The wording «לקוח המוגדר כקטין» (“a client defined as a minor”) indicates a manual staff flag, not a computed state. Nothing happens at 18.	ibid.; explicitly searched, nothing found
Binary access, no per-guardian granularity. The link is all-or-nothing.	ibid.
No signer identity on waivers. Guardian signs “in the child’s name” with no record of which guardian.	live page; whether the PDF names the signer is unverified
Entire help centre is 404. Verified three ways — curl, reader proxy, and a real Chromium tab. Customers currently have no documentation.	`intercom.help/boostapp-site/`

Arbox is architecturally better in one important respect and worse in others. It has קבוצה משפחתית with a ראש הקבוצה (group head) and already separates payer+communications from scheduling+attendance:

«אם תמר משלמת עבור בנה עמרי, תמר תוגדר כראשת הקבוצה ועמרי יוגדר כילד המשתתף. התשלום והתקשורת ינוהלו מול תמר, בעוד שהשיבוץ ביומן יהיה משויך לעמרי.» — help.arboxapp.com/he/articles/15804161

It also made email optional in favour of phone-as-primary-identifier (release 18.11.25, academy.arbox.co.il/lesson/new-releases ), enforces age/gender booking limits off the participant profile, and offers a group card token so dependants can buy without re-entering a card (release 10.06.25).

But: exactly one group head, no multi-guardian, no 18 transition, and the family group is essentially undocumented — there is no help-centre article for it. Arbox’s own documentation warns that the linkage is not reliable:

«לאחר הרכישה יש לוודא שהמסלול משויך למשתתף הנכון, שהמוצר הנלווה נוסף ושאמצעי התשלום שויך לגורם שאמור לשלם»

Staff must manually verify participant↔entitlement↔payer after every purchase. And a parent with two children must run the entire registration twice: «בכל תהליך רכישה ניתן לבחור מסלול אחד בלבד».

The security lesson, from a real Israeli breach

Fizikal — the largest installed base in this segment — was built on phone-number identity and suffered a documented account-takeover across “dozens of large Israeli gyms and community centres”, >1M cumulative downloads: 4-digit SMS OTP, no reset rate-limiting, user enumeration, brute-forced in “exactly one minute”. The attacker obtained phone numbers, names, national ID numbers, addresses, emails and birthdates, and could cancel a member’s subscription remotely (geektime.co.il , 10.8.20; fixed same day).

Direct relevance to TKN-382’s acceptance criterion. Phone-as-primary-identity plus a shared family phone number is precisely the shape that makes “an unrelated adult cannot access that record” fail. Arbox’s documented duplicate-profile hazard — «אם הלקוח כבר קיים במערכת, אין ליצור עבורו פרופיל חדש… כדי למנוע יצירת פרופילים כפולים» — is the same root cause surfacing as a data-quality bug instead of a breach.

This is a direct argument for a stable internal identity that is not the phone number or the email — which is what users.id already is — over any phone- or email-keyed shortcut.

Real user complaints, sourced and dated

The most valuable output of the competitor work. Each is a failure mode our design must not reproduce.

A grandmother, rejected. Reviewer handle «סבתא של משי» (Mashi’s grandmother), 24/01/2024: «לא נותן להרשם. דוחה משעורים שסימנתי» — a grandparent trying to book and being refused. apps.apple.com/il/app/1664837867
One person cannot hold two contexts. «אני מנויה בשני חדרי כושר. אין אפשרות לעבור ביניהם. רק אחד מופיע… מה שאומר שבחדר כושר אחד אין לי אפשרות כלל להירשם» — 17/07/2023, same URL. The same single-context limitation is what breaks a parent holding several children.
No per-participant schedule view. «כשאני נכנסת לראות שיעורים זה מראה לי את כל השיעורים לכל האוכלוסיות השונות. ילדים וכו. אני צריכה בכל פעם לסנן לפי סוג השיעור וזה מאוד לא נוח» — Smishmish, 30/05/2023, Fizikal white-label club app . A per-child filtered schedule is a named user request.
Health form dead end blocks booking forever. “once you sign, it does not let you go further, no button for DONE, so it’s incomplete and I can not use the app to book further sessions, I have to call the place each time” — Arbox, apps.apple.com/il/app/arbox . Our forms gate must not be able to reach this state.
Wrong-branch booking. “App doesn’t save branch, so you can accidentally book session at the wrong branch” — same URL. Directly relevant to an 18-site network and to the child-switcher design.
Registration-wave collapse. “Good application but can’t handle the load during registration. The issue repeats every week.” — Boostapp, 03/05/2025. Israeli kids’ classes open registration in synchronised weekly waves; a guardian booking for three children multiplies the thundering herd.
Cannot self-cancel. “extremely frustrating and unprofessional… to not have the ability for me to cancel a membership and I have to go through the studio. Especially if to sign up there is zero friction to get my card details” — Boostapp, 03/06/2025.

The target customer’s own published rules

Read directly from עולם המים’s policy pages — this is the operating model the feature must satisfy, in the customer’s own words.

Two plan tiers differing only by make-up entitlement. מסלול רגיל – כולל השלמות with a fixed weekly slot, 24-hour cancellation and same-month make-up; versus מסלול מוזל – ללא השלמות where «לא ניתן לבטל / להזיז / להשלים שיעור» but free-swim practice access is granted instead. swimming.co.il/forms/policy → Make-up eligibility is a property of the entitlement, it must attach to the child, it is time-boxed to the calendar month, and it differs by product tier. That is TKN-385’s real spec, and it confirms entitlement-on-the-child is correct.
Month-end recurring card charge; cash alternative is 3 months prepaid. Termination by form by the 28th, effective a month later.
Level-based reassignment after session 1: «ייתכנו מעברים בין הקבוצות לאחר השיעור הראשון על מנת להתאים… את רמת הקבוצה לילדכם» — participant level is mutable and per-program (TKN-383).
Their children’s waiver is written in the first person of an adult participant, even though the participant is a child: «הלקוח מצהיר כי מצבו הבריאותי מאפשר השתתפות בפעילות מים» and «חתימתי מהווה אישור כי קראתי את התקנון». There is no guardian clause, no “I am the guardian of X” assertion, and photo consent is an opt-out by verbally asking the photographer: «במידה ואין ברצונכם להצטלם הנכם מתבקשים לבקש מהצלם כי לא יצלם אתכם». swimming.co.il/forms/kids-group-course-terms

That last point is the single most concrete, demonstrable thing TKN-382 fixes for this customer, and it is also a compliance exposure for them today (see IL-35, IL-33).

The Israeli identity lever

Every Israeli resident receives a permanent, immutable מספר זהות at birth registration; the physical ת.ז. document is only issued from age 16 (he.wikipedia ). Both Arbox and Boostapp already collect ת.ז. on the participant record.

A child can therefore be uniquely and stably identified in Israel with no email, no phone and no login. Taikan can use ת.ז. as the natural-person key for children and reserve email and phone strictly for account holders — which structurally prevents the shared-phone collision that broke Fizikal. users.nationalIdEncrypted already exists for this.

Edge case that must be handled: adoption by court order reissues both the name and the ID number, deliberately severing the link to the biological parents. Any ת.ז.-keyed identity must support a hard identity re-key that leaves no discoverable trail back to the prior guardian, and guardian history must be purgeable in that one case. This is a genuine, citable edge case and it conflicts with our otherwise-correct “never hard-delete a guardianship” rule. Recorded as R-16.

2. The category that actually solved this: youth-activity software

General fitness software treats a child as a discount code. Swim/gymnastics/dance/camp software has first-class family objects. The vocabulary comparison is the useful artifact, because we have to pick names.

Product	Household object	Adult roles	Child term	Who logs in
Jackrabbit Class	Family (= Account); “the Student record is located within the Family record”	Contact — unlimited per family, “not limited to parents”; one is Billing Contact; Contact Types are a configurable list	Student	Contacts with “Allow to login to Parent Portal”. No student login documented
iClassPro	Family	Primary Guardian (exactly one) + Secondary Guardian(s); a guardian with portal credentials is a Secondary User; relationship labels configurable	Student	Primary Guardian + invited Secondary Users, who must confirm 18+
Sawyer	Client account (one per email)	Client = primary account holder; Adult = additional profile for anyone 18+; plus Secondary Contact / Caregiver Contact form fields	Child (<18); Participant = anyone being registered	Client only — “providers will use the primary email address… even if multiple contacts are listed”
Amilia SmartRec	Personal account → family account	Account Owner; invited members 14+ get their own login and own Wallet; Contacts carry a Role — Primary legal guardian / Secondary legal guardian / Emergency contact — plus a relationship label	Person, created explicitly as Adult ≥18 or Child <18	Account Owner + any person 14+ invited

Sources: Jackrabbit family record · Jackrabbit contacts · iClassPro secondary user access · Sawyer profiles · Amilia family account · Amilia contacts/roles

What this validates and what it changes

Validates:

Exactly one primary guardian — iClassPro ships precisely this. Our partial unique index matches an industry norm, not an invention.
Role on the link, not on the person — Amilia puts Primary/Secondary legal guardian and Emergency contact as roles on a contact link, which is exactly guardianships.relationship + capability booleans.
The registered subject is the member, not the account — Sawyer’s “Participant = anyone (client, adult, or child) being registered for an activity” confirms the modelling instinct: the subject of an enrollment is a person, independent of who holds the login. In revision 2 that person is a users row with kind = 'managed'; Sawyer reaches the same separation with a profile under a client account.
A non-participating adult is first-class — Jackrabbit Contacts and iClassPro Guardian records need no enrollment. This validates memberships.participation = 'guardian_only'.

Changes / adds:

Amilia gives a 14+ member their own login and their own wallet inside the family account. That is a more graduated model than our binary claim-at-16, and 14 is a defensible product threshold. Worth reconsidering selfAccessMinAge default — see Q-04.
Sawyer’s known weakness is a warning: one login per email, and providers correspond only with the primary address “even if multiple contacts are listed”. That is the co-parent complaint waiting to happen, and it is what our multi-guardian notification fan-out avoids.
iClassPro requires a secondary user to confirm 18+ before accepting portal access. Cheap, sensible, and we should copy it into the guardian-invitation acceptance step.
Configurable contact types (Jackrabbit) vs our fixed guardianRelationship enum. A fixed enum is the right call for v1 — it keeps the data queryable and the i18n tractable — but note that two independent vendors made it configurable, so expect the request.

2a. The multi-adult scorecard — harvested from the sub-agent slices

The four parent agents died on rate limits before consolidating, but their twelve sub-agents completed. This section is harvested from those payloads (agent://YouthActivityResearch.*, agent://FitnessCompetitorResearch.*). It is the most decision-relevant material in the whole research effort, because multi-adult support is the differentiator and this is the category that has tried hardest at it.

Product	Multiple adults	Own login per adult	Per-adult permissions	Split billing across households	Authorised pickup
DanceStudio-Pro / Studio Pro	Unlimited Contacts per student; “divorced parents who both need separate access” is a named use case	Yes — per-contact `Has Own Login`	Two comms tiers (Full / Limited), four channel toggles, `Block Login`	Yes, shipped — percentage-based Auto-Pay split	No
iClassPro	Primary + Secondary Guardians; Family Switcher lets one adult hold access to two families	Yes — Secondary User invite, must confirm 18+, expires in 48h	Two toggles only: `View Full Ledger`, `Can Make Payments`	Split payment yes, split invoicing no	No — “the single biggest child-safety gap in iClassPro’s documented model”
Jackrabbit Class	Unlimited Contacts, “not limited to parents”; per-contact Login ID	Yes, per contact	`Billing Contact`, portal block, and notably `Manage absences and makeups` per contact	Only by duplicating the family and splitting the children between two records	No
The Studio Director	No contact object at all	No — one `E-mail/Login` per family	None	Only by duplicating the family + manual `Add New Charge` per billing period	No
Kicksite	Two tiers: `Contact` (full profile) and `Guardian` (inline fields, no profile, no rights)	Partial/unverified for contacts	None at adult level	No	No
SwimTopia	Unlimited Parent records, Owner vs Member	Yes per parent	Subscribe/unsubscribe, site-wide admin, role bundles	No	No

DanceStudio-Pro is the genuine best-in-class, and it answers open question Q-02. Verbatim: “With the Split Payments option, you are able to set a specific amount that two different parents (grandparents, relatives, etc.) are charged when running Auto-Pay. This works exceptionally well in the case of divorced parents who split costs.” Mechanics: add the second adult as a Contact → Contact > Methods > Edit Payment Methods & Settings → save their card → designate what percentage of Auto-Pay to charge that card. (support.gostudiopro.com/…/19748198623117 )

Its documented limits are precisely where our opportunity is: the contact’s card is studio-entered, not self-service; payment plans cannot use the contact’s method, only the main parent’s; and what happens on a failed split payment is asked in their own comment thread and left unanswered. So if Q-02 comes back yes, the shape to implement is a percentage split on the payer side — and the thing to get right that the market leader has not is partial-failure handling and dunning against two payers.

Four failure modes to design away from

Each is a verified vendor behaviour, and each validates a choice already made in data-model.md.

iClassPro voids every policy acceptance when the Primary Guardian’s name is edited — and revokes all secondary access and deletes that guardian’s payment methods. Renaming a person destroys their signed consents. Our design stores attestationText verbatim on the grant with its own attestedAt/attestedIp, so identity edits cannot invalidate a signature. This is why the attestation is a stored string and not a pointer to a template version.
iClassPro requires the primary guardian’s email to be globally unique — “cannot already exist as the primary contact email address for any other family” — which structurally blocks one adult from being primary in two households. Keeping guardianship as a person↔person grant rather than a property of a family record avoids this entirely: email uniqueness stays a property of the login, not of a family role.
iClassPro secondary users “cannot create or manage enrollments for students… even with extended permissions”, and staff can revoke secondary access but cannot grant it — only the primary guardian can. So the market’s most-adopted multi-guardian model is read-mostly, and has no recovery path when the primary is uncooperative. Our canBook on a secondary guardian, and the staff-approved Route B in behavior.md §3.2, are both genuinely differentiated.
The Studio Director’s official guidance for two guardians is to put both names in one field and share one login — or duplicate the family and manually mirror charges every billing period. Jackrabbit’s official answer is also family duplication, with the caveat that families need “at least one student on each family account” or the second goes inactive. Family duplication is the category’s standard answer, and it is why waiver attribution is impossible in these products.

The category-wide gap worth owning

Not one product in this slice models authorised pickup. iClassPro, Jackrabbit, The Studio Director, DanceStudio-Pro, Kicksite and SwimTopia are all verified absent — no pickup roster, no check-out step, no signature capture at collection. SafeSplash solves it by policy instead of software: “Parents must remain at the SafeSplash facility for the entire duration of their student’s lessons.”

Given Israeli pool-safety regulation models an explicit supervision handoff, and Swim England’s Wavepower codifies a 20-minute non-collection escalation ladder, TKN-388 is a differentiator in a category where nobody has built it.

Two operational details worth copying

SafeSplash ships a third-party payer agreement: “Tuition… may be paid on behalf of a student by a third-party (i.e., someone who is not a parent or guardian). Any third-party payer must execute a third-party payer agreement” — with liability falling back to the original enrolling customer if the third party defaults. That is real-world validation of separating payerUserId from guardianship, plus the fallback-liability rule we had not considered (see risks.md B-06).
SwimTopia advises creating a teen’s volunteer login as a parent-type record “so the teen doesn’t inflate the billable athlete roster count.” That is exactly the hazard memberships.participation = 'guardian_only' exists to prevent, confirmed as a live operational problem a vendor has to warn customers about.

Make-up: the engine spec, verified

Adjacent to TKN-382 but it validates entitlement-on-the-child. iClassPro’s Makeup Token is a first-class expiring entitlement with auto-generation on absence, configurable expiry in days, per-year/per-month caps, cross-program and cross-location toggles, a booking horizon, and redemption restricted to “same Class Level as an active enrollment”. SafeSplash’s policy layer is stricter and more instructive: one makeup per calendar month, completed within two weeks, location-locked, credits expiring one year after application, and — directly relevant to our open question Q-08 — “makeup rights are non-transferable between students.”

That last clause is an operator in this exact vertical having already decided that entitlement does not move between siblings. It supports keeping credits with the child on revocation, and it is a precedent worth citing to the operator.

3. Pattern catalogue: fifteen patterns from mature consumer platforms

Named patterns, each verified against primary documentation, with an explicit adopt/reject decision for Taikan. The full catalogue with mechanics and sources is at agent://FamilyPatternResearch.

#	Pattern	Exemplars	Decision for TKN-382
P1	Cabined Capability — account exists and is usable, but named capabilities stay off until a guardian completes consent. Epic: account works, purchases/chat/recommendations disabled; unlocks automatically at the local consent age with no guardian action.	Epic Cabined Accounts, Roblox, Instagram Teen, YouTube BR	Adopt. A child can be enrolled, appear on the roster and have attendance recorded immediately, while booking, payment, messaging and photo-dependent activity stay locked until the guardian finishes consent. This is how we avoid a dead-end enrollment at the front desk.
P2	Participation Without an Account (both directions) — Nintendo: “you do not need an email address for the child” and emails cannot be registered for a child account; transactional mail goes to the family admin. Google mints a synthetic non-deliverable `…@glimitedaccount.com` identifier, later upgradeable to a real login without changing the account. Upward: Google Classroom guardian summaries reach an adult with no Google account at all.	Nintendo, Google, Apple, Google Classroom	Adopt, and it is the core requirement. Email is a routing mechanism, not an identity. Note Google’s synthetic-address trick is the rejected alternative from `data-model.md` §2 — we get the same outcome without polluting the identity table. Upgrade-without-changing-the-id is exactly `participants.userId` being set on claim.
P3	Assertion Provenance — store how a fact was established, not just the fact. Apple’s `AgeRangeDeclaration` ships `selfDeclared` / `guardianDeclared` / `confirmed` alongside the value, and returns an age range, never a birthdate. ISO/IEC TS 27560:2023 mandates “Expression by Entity” — whether the subject or their guardian expressed the consent. AWS `sourceIdentity` is immutable for the session, survives role chaining, and is policy-enforceable.	Apple, ISO 27560, AWS STS	Adopt. Every waiver, health declaration, age and photo consent carries `{value, asserted_by, method, timestamp}`. A staff-entered DOB and a guardian-signed declaration are not the same fact and must not be stored identically. This is why `form_signatures` gains `signedByUserId` + `signedInCapacity` + verbatim `attestationText`.
P4	Delegation vs Impersonation — RFC 8693 draws the line: under impersonation the actor “is indistinguishable from B”; under delegation “A still has its own identity… any actions taken are being taken by A representing B”. Claims: `sub` (subject), `act` (current actor, nestable), `may_act` (pre-authorised). Exchange ships the same triad as product: Send As (invisible), Send on Behalf (attributed), Full Access (read, cannot send).	RFC 8693, MS Exchange, Salesforce	Adopt delegation, reject impersonation. This is the decisive argument against the Clerk actor-token approach: a guardian must never be indistinguishable from the child. `bookings.bookedByUserId` + `audit_events.actorCapacity` are the `act` claim; `guardianships` is `may_act`. Salesforce’s documented blind spot — “Log in as another user” not appearing in Login History — is the failure to avoid.
P5	Graded Permission Ladder, incl. Write-Without-Read — Google Calendar’s “Make changes (see private events as free/busy)” grants write authority while content stays opaque. Loma Linda MyChart adolescent proxy tiers permit check-in, messaging, appointments and payments while restricting clinical notes to “Limited View” and labs to immunisations/growth charts only.	Google Calendar, Loma Linda, MaineHealth, Nintendo	Adopt. Acting rights and reading rights are separable in both directions. “Write without read” is the template for the teen case: a parent can book a 16-year-old’s lane slot without seeing the coach’s notes or body composition. This is precisely `canBook = true, canViewHealth = false`.
P6	Metadata-Not-Content Visibility — Instagram: parents “can see who their teen has been chatting with in the last 7 days, but not the content”. YouTube supervised: parents see counts, not content. Apple: “the Family organizer will continue to receive receipts… even if family members have hidden their purchases” — financial visibility survives content concealment.	Instagram, YouTube, Roblox, Apple	Adopt as the default guardian view. Default: attended/absent, which class, which coach, which slot, amount charged. Behind a separate grant: coach’s written notes, incident detail, body metrics, message bodies. The payer always sees the charge even when programme detail is restricted — that resolves the payer-who-is-not-a-guardian case cleanly.
P7	Age-Triggered Capability Downgrade — MaineHealth converts Child Proxy to Adolescent Proxy automatically on the 12th birthday, keeping messaging/appointments/immunisations, losing results/medications/histories, with a published rationale and a published workaround table (“For health history, call the provider’s office”). NHS: automatic cut-off between 11 and 14, access “usually ends at 16”, and crucially — “When your online access ends, you will still be able to manage your child’s health and care at the GP surgery in the same way you do now.”	MaineHealth, Loma Linda, NHS, Apple Watch	Adopt the mechanism; the policy tier is Q-04. The NHS line is the key insight: a digital restriction must never be mistaken for removal of parental authority. Every downgrade screen must name the out-of-band path (“speak to the branch”). Apple Watch’s substitution approach — under-13s get move minutes instead of active calories — is the right model for child body metrics.
P8	Ratchet Permission — self-service tightens, loosening needs approval. Instagram: 13-15 cannot make settings less strict without a parent; Google: “children need parent approval to stop supervision until they turn 18”.	Instagram, Google, Apple	Adopt. A teen may unilaterally restrict who sees their progress or opt out of photography; re-widening it, or removing a guardian’s booking right, requires the guardian or staff with a logged reason. Cheap to implement, prevents a whole class of argument.
P9	Bilateral Grant, Asymmetric Revoke — three production answers exist. Symmetric: YouTube, either party may unlink. Dependent-favouring: Loma Linda, the teen grants and may revoke. Grantor-locked: Microsoft — “You only have permission to remove consent for a child account if you originally granted consent”, with the documented failure “If you cannot access your account, the child may lose access”.	YouTube, Loma Linda, MS, Nintendo, Classroom	Adopt bilateral grant; explicitly reject grantor-locked. Microsoft’s model produces unrecoverable states with divorced parents and grandparents — exactly our population. Copy Google Classroom’s details: an explicit “I’m Not The Guardian” rejection path, invitation expiry, both parties notified on accept, and the participant notified when a guardian removes themselves.
P10	No-Orphan Invariant and Custody Transfer — Apple: “There’s no other way to remove a child from a family group if they’re under 13” — the only exits are transfer or deletion, and transfer is a two-sided handshake where the receiver confirms adult status “and that they have authority to act on behalf of the child”. NHS supports many-to-many explicitly and requires the surgery to “check with anyone else that shares parental responsibility” and “make sure the child is not at risk of harm” before granting.	Apple, Steam, NHS, Loma Linda	Adopt. Validates `behavior.md` §7.4’s orphan-as-incident-state. Custody transfer is a dual-approval flow. Deliberately diverge from Apple on one point: Apple erases the provenance (“Apple does not maintain a record of the fact that the transferred child was previously part of a different family group”); Taikan must retain prior-guardian history for safeguarding and billing disputes — except in the adoption case (R-16). Loma Linda excludes foster carers from proxy entirely (“cannot be granted in cases of temporary custody”) — a question for us, Q-11.
P11	Published Capability Ceiling — Family Link ships a headed section “What parents can’t check or do”, enumerating ten specific things. Google Wallet publishes the post-graduation ceiling. Note the origin dependency: limits differ depending on whether supervision was retrofitted onto a pre-existing account or the account was parent-created.	Google, MaineHealth, Instagram	Adopt. Ship a visible “What a guardian can and cannot see” page in he/en/ru. Honour the origin dependency: a membership migrated from an existing adult account must not silently acquire guardian-resettable credentials. That is a real migration trap for our import path.
P12	Graduation with Escalating Notice — Google Wallet notifies both parties at 30 days, 7 days, and on the birthday; cards left in the account at the boundary “can no longer be removed by the parent”. Nintendo requires the dependent to register an email before supervision can be removed — a contact channel as a precondition of independence. Israel’s own `חיסכון לכל ילד` is the cleanest ladder: funds in the child’s name, 18-21 withdrawal only with parental approval, from 21 without.	Google, MyChart, Apple, Israeli NII, Roblox, Nintendo	Adopt wholesale. Notify at 30/7/0 days. Provide an overlap band where the young member books for themselves while the guardian retains payer and emergency-contact rights. Require the participant to establish their own contact channel and re-authenticate any inherited payment method at the boundary. The Israeli savings scheme is a locally-legible precedent worth citing to the operator.
P13	Delegation Cooldown — Google: change family groups once per 12 months; Amazon: 180 days; Steam: one year; Spotify: members must share a home address.	Google, Amazon, Steam, Spotify	Reject as a family control — it is an economic anti-abuse device for benefit-sharing, and our population is siblings, divorced parents and grandparents who must be re-linked freely. Borrow only invitation expiry, and consider a cooldown on changing the payer of an active monthly subscription mid-cycle.
P14	Dual-Key Consent with Non-Retaliation — Swim England’s Wavepower (mandatory for all affiliated clubs and swim schools) requires for publishing a child’s photo “parental consent, and consent from the child”; both hold a veto; and “The exercise of this right of refusal should not be used as grounds for refusing entry into a competition.”	Swim England Wavepower 2024, Apple	Adopt for photo/media/publicity. This is a swim-specific governing-body rule and our design partner is a swim network. Store two consent events with provenance, honour either veto, and never let a photo refusal block class registration or make-up eligibility. Directly fixes עולם המים’s current verbal opt-out.
P15	Named-Escort Release Control — Wavepower codifies the escalation ladder on non-collection: call emergency numbers to arrange a nominated person; ask the child for other family contacts; after 20 minutes seek advice from Police / Children’s Social Care; never leave the child alone unless over 16 and the parents previously agreed; two appropriate adults remain until collection; refuse release to an apparently-intoxicated collector.	Swim England Wavepower 2024, airlines (unverified)	This is TKN-388’s specification, written for us. TKN-382 provides only the seam (`canAuthorizeEscorts`). Note Wavepower’s self-release rule needs age plus explicit prior guardian agreement — two conditions, not one.

4. Compliance constraints

Full table with sources at agent://MinorsComplianceResearch. The eight that most shape the data model and UX:

קטין = under 18; בגיר = 18+; there is no intermediate legal tier (חוק הכשרות המשפטית והאפוטרופסות ס’3 ). The Privacy Protection Law contains no age threshold at all and the word קטין does not appear in it (חוק הגנת הפרטיות ס’3 ).

Correction this forces: behavior.md §5.1 justified selfAccessMinAge = 16 by reference to the EU Art. 8 ceiling. For the primary market that reasoning is wrong — there is no Israeli 13 or 16 threshold to align to. 16 is a product threshold, and must be labelled as such. The legal gate is 18. Do not invent an Israeli digital-consent age.

C2 — In Israel one guardian’s action is presumed consented to by the other. In France it is not.

Israel: both parents must act by agreement, but one parent’s consent to the other’s act may be prior or retroactive, express or implied, and there is a rebuttable presumption that a parent consented until the contrary is proven; in an urgent matter either may act alone (ס’18 ). For gym training specifically, the written consent of one parent suffices by statute (חוק מכוני כושר ס’4(ג) ).

France: parental authorisation must in principle come from both parents, irrespective of relationship status or whether they live together (CNIL ). Spain 14 with a carve-out, France 15 with dual child+parent consent, Ireland 16, Germany 16.

Engineering consequence: consentQuorum must be a per-jurisdiction policy, not a constant. IL = one guardian with presumed concurrence; FR = all holders of parental authority. Any single-guardian shortcut hard-coded for Israel is unlawful in France. Additionally, store a per-guardian objectionLodged flag that rebuts the Israeli presumption and forces dual authorisation for that child. This is new and is not in the current behavior.md.

C3 — Custody is not guardianship. A non-custodial parent normally retains data-access rights.

Separated parents may agree who holds guardianship, subject to court approval; absent agreement the court decides (ס’24-25 ). A court may deprive or limit guardianship (ס’27 ).

Do not gate access on “lives with”. A non-custodial parent retains representation and therefore data access unless a court removed it. Guardianship must be limitable by an out-of-band admin action evidencing a court order, with an effective-from date and a retained audit trail — and never hard-deleted.

C4 — There is a direct statutory precedent for hiding a child’s data from one parent.

Where a practitioner learns that a parent has been convicted of, or charged with a sex or violence offence against their minor child, that parent’s consent is not required for treatment and information about the child’s treatment shall not be given to that parent (חוק זכויות החולה ס’16א ).

Engineering consequence: implement guardianships.accessSuppressedFrom / _reason / _evidenceRef, enforced at the query layer, with the suppression itself invisible to the suppressed guardian. This is the sharpest single requirement the legal research produced, it has clear statutory grounding, and it is absent from the current design. It also means “revoked” is not a sufficient status vocabulary — suppression must be distinguishable from revocation.

C5 — The guardian portal is a statutory right, and the audit log must say whose right it is.

Every person may inspect data about themselves held in a database — personally, through a written-authorised agent, or through their guardian (ס’13(א) ).

So the audit log must record “guardian X exercised child Y’s access right”, not “guardian X viewed their own data”. That is exactly audit_events.subjectParticipantId + actorCapacity. Health data has a special branch: the controller may withhold medical information where disclosure could cause serious harm, delivering it instead to a nominated clinician (ס’13(ג) ) — so health disclosure needs a three-way outcome, not allow/deny.

C6 — Health declarations have statutory TTLs, statutory retention, and booking must be blocked on expiry.

Health declaration refreshed every two years; where a medical certificate was required (any “yes” answer) every year; retention two years from signature (חוק מכוני כושר ס’4(ד)-(ו) + תקנות תשע”ו-2015). Separately, the Sports Law requires a competing athlete to complete a medical questionnaire every season and a physical exam every year (תקנות הספורט (בדיקות רפואיות) תשע”ד-2014 ).

Two distinct health artefact types with different cadences, both attaching to the child, both blocking on expiry. behavior.md §4.3 listed re-signature triggers as a product choice; for Israel they are a statutory requirement. And member_profiles.medicalCert being a bare boolean is not merely insufficient — it cannot express an expiry date.

Two further statutory scheduling constraints, neither in scope for TKN-382 but both dependent on it knowing the participant is a minor: minors under 6 may not train in a gym at all, and a qualified minors-training instructor must be present whenever minors train (ס’3(ב)(1) + תקנות תשס”ה-2005). Staff qualification becomes a bookable constraint, not an HR attribute.

C7 — Israel’s de-facto COPPA bites at 18, not 13, and it covers ordinary push notifications.

No advertising or marketing method may use, directly or indirectly, a minor’s personal details — name, address including email, phone, bank or card details — except with the consent of a parent or guardian. “Marketing methods” is defined extremely broadly: any direct, indirect, overt or covert approach including any kind of electronic communication, aimed at entering a transaction or promoting sales. Minor = under 18. Exempt: using the details to deliver a service the trader owes the minor (תקנות הגנת הצרכן (פרסומת ודרכי שיווק המכוונים לקטינים) תשנ”א-1991 ).

The same regulations forbid marketing that exploits minors’ impressionability or trust, encourages them to pester their parents to buy, or makes them feel deprived if they do not.

Engineering consequence — concrete and new: every outbound message needs a purpose classification {transactional, promotional}; promotional sends touching an under-18 participant are hard-blocked absent a guardian consent record. And it rules out gamified streak pressure, scarcity mechanics and “ask your parent” nudges in any child-facing surface — including anything Spotter generates. This is stricter than COPPA and applies to our primary market.

C8 — Health data is special-sensitivity, and the fine is per data subject and doubles.

“Special sensitivity information” expressly includes state of health and medical information (ס’3 ). A database with medical information is at medium security level, escalating to high if it holds 100,000+ people or if the number of authorised users exceeds 100 (תקנות אבטחת מידע תשע”ז-2017 ). Administrative fines under Amendment 13 run at NIS 4 per person, doubled to NIS 8 for special-sensitivity data, floor NIS 200,000 (ס’23כו ).

A 170-employee network exceeds 100 authorised users, so the health-bearing database sits at HIGH level: documented risk survey, penetration tests at least every 18 months, quarterly security-event review. A 40,000-record health-bearing database processed for an unlawful purpose is ~NIS 320,000 before aggravation.

Engineering consequence: minimising which records carry health data and how many staff accounts can read it is a direct cost lever on the security regime. This is a real argument for isolating health declarations behind their own access boundary rather than letting them sit in the general member profile — and it is the economic justification for canViewHealth being separable. Breach notification is immediate, not 72 hours, and at high level the trigger is any unauthorised use.

Also material, briefly

Outsourcing (IL-19): Israel’s DPA equivalent requires an eight-item contract, annual processor compliance reporting, and sub-processor flow-down. Clerk, Postgres host, PostHog and any AI provider need flow-down clauses. The amended COPPA rule’s §312.8(c) written-assurances duty is close enough that one combined vendor-assurance artefact can satisfy both if drafted to the union.
Mandatory reporting (IL-31): a swim school to which a child is entrusted under contract is plausibly “responsible for the minor”, and its staff plausibly within the professional reporting duty. Consequences: never promise confidentiality in any channel touching a minor; build an escalation path from any message channel to a safeguarding queue; message content is potential evidence, so retention must not auto-purge below the limitation period. Do not design a private DM between a coach and a minor. This is Q-05 and it is the question I would put to counsel first.
COPPA (US-2, US-4): a commercial gym cannot stand in the parent’s shoes the way a school can — the school-consent exception is limited to the educational context “and for no other commercial purpose”. So no “the club consents on behalf of members” shortcut for US tenants. The natural verifiable-parental-consent method is §312.5(b)(2)(ii) — a card transaction that notifies the account holder — which the guardian is already performing. Bind the consent record to the payment-notification event.
Retention conflict (US-7 vs IL-25): COPPA forbids indefinite retention and requires a published retention policy; Israeli law mandates two-year retention of health declarations. Retention must be per-tenant policy, never a global constant.
Age assurance (EU-8): EDPB Statement 1/2025 — age assurance often requires a DPIA, and self-declaration has little robustness. If we ever need to establish minority, store an over/under boolean plus a verification-method code, never a scan or face image, and never reuse the signal for segmentation or pricing.
Erasure at majority (EU-6): Recital 65 — at 18 the former child must be able to erase data given on their behalf as a minor, including data a guardian supplied. Erasure must not cascade into the guardian’s own records.
AI (IL-37, EU-10): the Israeli PPA’s AI guideline names “information about special populations such as minors” as a high-risk factor, requires bot disclosure, and expects a PIA. AI Act Art. 5(1)(b) prohibits exploiting age-based vulnerability to distort behaviour, in force since 2 Feb 2025. Recommendation: exclude minors’ records from AI training and inference-heavy features by default, and keep Spotter out of child records until a PIA exists.

5. What this research changed in the design

Finding	Change
C1 — no Israeli digital-consent age	Relabel `selfAccessMinAge` as a product threshold; legal gate is 18. Fix the rationale in `behavior.md` §5.1.
C2 — IL one-guardian presumption vs FR joint consent	New: `consentQuorum` per-jurisdiction policy + per-guardian `objectionLodged` flag.
C4 — statutory parent data-suppression precedent	New: `accessSuppressedFrom` / `_reason` / `_evidenceRef` on `guardianships`, enforced at query layer, invisible to the suppressed guardian.
C6 — statutory health TTLs and blocking	Health artefacts need expiry dates and differentiated TTL (24m / 12m / seasonal); expiry-blocks-booking is statutory, not a product choice.
C7 — marketing to under-18s needs guardian consent	New: `{transactional, promotional}` purpose classification on every outbound message; hard block on promotional to minors. Rules out streak/scarcity mechanics for children.
C8 — >100 staff ⇒ HIGH security for health data	Argues for isolating health data behind its own boundary; `canViewHealth` separability is now economically as well as ethically justified.
P1 Cabined Capability	Enroll-now, capabilities-unlock-on-consent instead of blocking enrollment.
P4 Delegation vs Impersonation	Confirms rejecting Clerk actor-tokens for guardians.
P6 Metadata-not-content	Sets the default guardian view; payer always sees the charge.
P12 Escalating notice	30/7/0-day notification before majority; contact channel as precondition; re-auth inherited payment method.
P14 Dual-key consent	Photo/media consent needs guardian and child assent, with non-retaliation.
Boostapp fuses guardian+payer; Arbox has one group head	Our multi-guardian + separable payer model is the differentiator. Lead with it.
Fizikal breach via phone identity	Confirms a stable internal id (`users.id`) over any phone- or email-keyed shortcut.
ת.ז. issued at birth	Viable no-login identity key for Israeli children. Adoption re-key is the edge case (R-16).
”No per-participant schedule view” complaint	Per-child filtered schedule is a named user need, not a nice-to-have.

6. What we could not verify

Stated plainly rather than inferred.

Item	Why
Fizikal’s child/guardian model (structure, booking, billing, 18-transition, multi-guardian)	No public help centre; `admin.fizikal.co.il` is login-gated. Every page in their sitemap was read, including the dedicated children’s-classes page; none describes the model. Only a paid demo would resolve it.
Rapid Image / RapidOne — everything	No public documentation of any kind; the courses-module page is marketing boilerplate padded with unrelated PBX copy. Demo-gated. Notable: their customer logo strip includes עולם המים — so the discovery customer’s incumbent stack is Arbox + Fizikal + a clinic-derived system, and no vendor in it was built around a participant≠account-holder model.
Boostapp help-centre articles at full length	The entire Intercom workspace 404s for every locale and article; verified by curl, reader proxy and a real Chromium tab. Hebrew quotes are from a search engine’s index of those exact URLs, marked `[SEARCH-INDEX]`, and the substantive minor-account claim is independently corroborated by their live marketing page.
Israeli operator complaints from Facebook owner groups	Those groups are closed and not machine-readable. Substituted App Store IL reviews — public, attributable, dated, and including reviewers who are demonstrably parents and grandparents.
Remaining EEA Art. 8 ages (beyond IE/ES/FR/DE)	Delegated to a sub-agent that was rate-limited before returning. Mitigation: default the age to 16 (the GDPR fallback), which is always the strictest and therefore safe for any unconfigured country.
Airline unaccompanied-minor mechanics	delta.com and britishairways.com blocked automated retrieval (HTTP 444 / 403). Claims came from search citations and SEO intermediaries — treat as unverified. Wavepower carries the same pattern from a primary source, so nothing depends on it.
Consolidated competitor tables for Mindbody / Glofox / Zen Planner / Wodify / TeamUp / Momence / ClubReady / Virtuagym, and the youth-sports set (TeamSnap / SportsEngine / Playmetrics / LeagueApps)	Their sub-agents were mid-fetch when the account hit its rate limit, and unlike the others they returned nothing usable. Assessment: low marginal value, and this is now a considered judgement rather than a hopeful one. The harvest in §2a closed the question these were meant to answer — the youth-activity category, not general fitness, is where multi-adult support actually exists, and six products in it are now verified. General fitness software treats a child as a discount code. Worth a short follow-up only for Mindbody’s family-billing mechanics, and only if consolidated invoicing is prioritised.
Whether Boostapp’s signed PDF names the signing guardian	Would require a customer account. Material only as competitive colour; our own design records it regardless.

A note on the research infrastructure

Two defects surfaced that affect the reliability of any future research run and should be fixed before the next one:

agent-browser CLI is not installed on this machine (exit 127), despite being the documented interface in the agent-browser skill. The working path is the Eval browser global.
Cross-agent tab contamination on the shared Chromium. SwimVerticalResearch reported that tab.evaluate returned the DOM of another agent’s page despite a unique tab name, and that its cell closed a foreign tab it never named. Mitigation adopted mid-run: re-assert location.href inside every evaluate and discard any payload whose URL does not match the request. Any single-source claim gathered via the browser before that mitigation carries a small contamination risk; the claims retained above were either URL-asserted or independently corroborated.