Currently assumed away

The alert has to reach the child it was built for

A specification that assumes a sound reaches a child and an application reaches a guardian has quietly decided which children and which guardians it is for. Neither assumption was ever written down, which is exactly why neither was ever argued.

Footage: Vincuk Konan / Pexels

The Anchored Zone Assessment introduces this with three words: accessibility is "currently assumed away." That is the right diagnosis. Nothing in the specification excluded anybody deliberately. Two assumptions were simply made and never stated - that an alert can be audible, and that a guardian can be reached through an application - and an assumption nobody wrote down is an assumption nobody had to defend.

This is a design document, so the remedy available to it is the one that matters most and costs least at this stage: write the requirement now, argue it in the open, and make it something a vendor has to meet rather than something a vendor is asked about. The Assessment ranks this sixth in its priority table with the plainest reasoning on the list - cheapest to fix now, hardest to retrofit, highest-risk population.

A protective system that works less well for the children at highest risk has inverted its own purpose.

That is the Assessment's closing line on this subject, and it belongs on this page as a design principle rather than as a compliance note. A compliance note is satisfied by a statement of intent. A design principle decides what gets built: it says that if two designs are on the table and one of them serves a typical ten-year-old slightly better while serving a disabled child considerably worse, the second design is not a trade-off - it is a failure of the thing the system is for.

The normative form of this page is SP-116 to SP-121. The argument for those clauses is below.

What this design has already settled, and what it therefore has not

Before adding requirements it is worth being exact about which alert is under discussion, because two of the three alerting decisions on this site were already made for other reasons and both of them happen to help here. Getting this wrong would produce a page arguing about a loudspeaker the child never had.

Already decided, and already helping

The monitored person's warning is haptic and private. W-4 permits a vibration and text on that person's own device and nothing a bystander can perceive. It was written to stop an audible warning de-anonymizing someone in the street. It also happens to be the accessible form, and it is the model the rest of this page argues from.
The child-side band is optional and receive-only. The topology gives it no detection role at all: it carries a local alert and never announces anything. No page of this specification has ever given that band a sounder.
The guardian notice at the middle tier is silent by design. On the tier ladder a guardian is told before anything public happens, which means the guardian channel is the one that carries the most weight and the fewest people hear.

Still open, and what this page is about

The guardian channel. It is specified as a notification and nothing else. That is the single largest exclusion in the design, because it is the channel that actually reaches a responsible adult.
Any local alert the child receives. The band's alert has never been specified in modality at all. An unspecified modality becomes a buzzer and a chirp on the first hardware review.
The audible alert at the top tier. It is emitted at the site, by the anchor, to the adults who are present. It is not the child's alert and must never be justified as one - and it lands on a child who is standing there whether or not it was aimed at them.
Every public-facing element. The published zone map, the appeal route, the correction notice. A boundary a person cannot read is not a boundary they were given.

Five requirements, each with the consequence that makes it one

SP-116 The alarm is for the adults present, and the child is told a different way

Haptic and visual alerting must be equivalent, not secondary. The word doing the work is equivalent, and it is a testable word: the same information, at the same moment, driving the same next action, with the same escalation behind it. Not a copy of the real alert. Not a courtesy duplicate that arrives after the sound.

Secondary channels drift. A channel that is defined as a fallback stops being tested first, loses the fields that were added later, and by the second firmware release carries less than the primary one - and nobody notices, because the people who test the product hear the beep.

The consequence. Equivalence has to be an acceptance criterion with a named test, not an adjective in a requirement. If a deaf child receiving the haptic and visual alert cannot take the same action, in the same time, on the same information as a hearing child receiving the sound, then the product does not meet this clause however many modalities it lists on the box.

SP-117 Designed with them, not adapted for them afterwards

Children with cognitive or developmental disabilities are, as the Assessment states it, a population at markedly elevated risk of abuse. This design document carries that as the Assessment's claim and does not restate it as a measured figure of its own, because the requirement does not depend on the size of the number and overstating it would be the wrong way to win the argument.

An alert designed for a typical ten-year-old assumes the recipient will notice it, interpret it, remember what it means, and act on it - four separate cognitive steps, under stress, from a device that has just interrupted them. A child who cannot complete the third step is not served by making the first one louder, and that is what adaptation-afterwards always produces: the same alert, amplified.

The consequence. Co-design has to be a procurement obligation with an evidence requirement attached: the vendor names who participated, at what stage, and publishes what changed as a result. A design review that produces no changes did not happen. This is also the clause that decides the shape of the alert itself - one action, not a decision tree, because a decision tree is a design that assumes the capability it should have been testing.

SP-118 A loud noise is not a neutral intervention

Non-verbal and autistic children may respond badly to a sudden loud alarm, and badly here can mean distress, flight, or freezing - which are the three responses least compatible with what the alert exists to achieve. The design cannot treat sound as a costless channel that some people simply do not receive. For some children it is an intervention with its own harm, delivered at the worst possible moment.

This has a direct structural consequence at the top of the ladder. The audible alert there is already the most heavily gated output in the system, for a different reason - it de-anonymizes the monitored person to everyone in earshot. That gating helps here too, and it is not sufficient here, because the harm this clause is about lands on a child who is present rather than on the person the alert is about.

The consequence. No alert reaching a child may depend on a sudden loud sound. The child-side modality is set per child at enrollment, by the people who know that child, and it defaults to the least startling modality that is adequate rather than to the most attention-getting one. And the site-level audible alert is specified as what it is - an alert to adults present - so that it can never be counted as the child having been told.

SP-119a Multilingual alerting, for guardians and for anything public-facing

An alert in a language the recipient does not read is a notification that something happened, which is the worst possible outcome: enough to alarm, not enough to act on. Language is a property of the guardian, recorded at enrollment, not a property of a handset's locale setting - because the handset belongs to whoever is holding it and the guardian may not be the person who configured it.

The public-facing elements matter as much and get forgotten more. The published zone map exists because due process requires that a boundary be knowable before it is enforced, and a boundary published only in one language has not been made knowable to everyone it binds. The same applies to the appeal route and to any correction notice.

The consequence. Translation is part of the specification, not a localization task afterwards, because the alerting text is a fixed and small set - the four fixed lines of the warning are the model - and a translated alert that hedges, softens, or adds a qualifier is a different alert with different legal weight. Each translation is reviewed against the original for exactly that, and the reviewed set ships together.

SP-119b An application notification is not accessible to every guardian

The guardian channel carries the most consequential message the system sends: it reaches a responsible adult before anything public happens. Specifying it as a smartphone notification excludes guardians without a smartphone, guardians without data, guardians whose vision or hearing makes an unlabeled notification useless, guardians who cannot operate a touchscreen quickly under stress, and guardians in a household where the phone is not theirs to check.

Alternate channels are therefore required rather than offered, and each has to carry the same content - including the constraint that has governed every alert on this site: it names a place and never a person.

The consequence. Channel choice is per guardian, set at enrollment, changeable by the guardian, and more than one may be active at once. Every channel is subject to the same delivery evidence: the system records that a notice was sent and through which channel, because a guardian channel nobody can prove was delivered is a guardian channel that will be disputed in exactly the case where it matters.

Alert channels against who each one excludes

This is the table the person writing the requirement needs, and it is deliberately uncomfortable: every channel in the system excludes somebody, including the ones added for accessibility. The design position is not that an accessible channel exists. It is that no channel ships alone.

Channel	Who it reaches	Who it excludes	The equivalent that must ship alongside it
Audible alert at the site, emitted by the anchor at the top tier	Adults present and paying attention, within earshot.	Deaf and hard-of-hearing adults present. Anyone outside the radius. Anyone wearing hearing protection or headphones. It also lands on autistic and sound-sensitive children who are simply there.	A visual annunciator at the site, firing at the same instant, plus the guardian channel firing simultaneously rather than afterwards. The sound is never the only notice that the top tier was reached.
Haptic on the child's band	A child wearing the band, in most circumstances, without telling anybody else.	Children with reduced tactile sensation. Children whose band is in a bag rather than on a wrist. Children who do not have one - the band is optional by design.	A visual signal on the band, and the guardian channel, which never depends on the band existing at all.
Visual on the child's band	A child who is looking, or who notices peripherally.	Blind and low-vision children. Any child whose band is covered by a sleeve, in a pocket, or behind them.	Haptic as the paired modality, plus an audible option that is enabled per child by the people who know that child rather than by default.
Guardian application notification	A guardian with a compatible phone, data, the application installed, and notifications permitted.	Guardians without a smartphone or without data. Blind guardians, if the notice is an unlabeled graphic. Deaf guardians, if the application relies on a sound to raise it. Guardians for whom the phone is shared or is not theirs.	Text message and a voice call carrying the same words, both selectable per guardian, both recording delivery. The application is one channel among several rather than the channel with alternates.
Voice call to a guardian	Guardians with a telephone and no application, including guardians who read little.	Deaf and hard-of-hearing guardians. Non-speaking guardians. Anyone who cannot answer at that moment, which on a live alert is the common case.	Text message and relay-service compatibility, plus a message left in the same fixed wording so an unanswered call still delivers the notice.
Text message to a guardian	Almost every handset, with no application and very little data.	Guardians who do not read the language it is sent in. Guardians with low literacy. Blind guardians whose handset has no screen reader.	The same notice in the guardian's recorded language, and a voice call in that language, so that literacy is never the thing standing between a guardian and the message.
Private haptic and screen warning to the monitored person	The monitored person, discreetly, which is what the design requires of it.	Monitored people who cannot read the language of the warning, or cannot read. Blind monitored people. This is a due-process exclusion, not only an accessibility one - an unreadable warning is not notice.	Private spoken audio through an earpiece or the device's own accessibility output, in the language recorded at enrollment, with the wording fixed and identical across forms.
The published zone map and the appeal route	Anyone who can find, open and read the published material.	Blind and low-vision readers, if the map is an image. Readers of every language it is not published in. Anyone without an internet connection, for whom nothing was published at all.	A machine-readable published form that a screen reader can traverse, a written description of every boundary in words, publication in the languages the jurisdiction serves, and a route that does not require a device.

The rule the table is really stating

Read down the exclusion column and the pattern is that every single-channel design excludes a group, and no amount of engineering removes that. What removes the harm is pairing: each channel ships with a named equivalent that carries the same content at the same moment, and the pairing is specified rather than left to whoever writes the notification service. That is a cheap requirement now and an expensive one later, which is the entire argument for putting it in a design document rather than in a review.

The procurement consequence

This is the part that decides whether any of the above happens, and it has nothing to do with design.

Accessibility requirements that are not in the specification do not survive contact with a vendor

A requirement in a specification is something a bid is scored against and a contract can be enforced on. A requirement in a design review is a conversation, and it loses that conversation to schedule every time - not through bad faith, but because the person defending it has no clause to point at and the person cutting it has a delivery date.

The failure mode is specific and it is worth naming so that it can be recognized while it is happening: the product ships with an alert designed for a typical child, accessibility is logged as a fast-follow, the fast-follow is scoped as adding modalities to the existing alert, and what results is the same alert made louder and brighter. Retrofitting an alert designed for a typical child is not a partial success. It is how this fails.

So the clauses belong in four places, and all four or none: in the numbered specification, in the acceptance test with named criteria rather than an adjective, in the pre-registered evaluation so that the system is measured on whether it reached the children it was hardest to reach, and in the contract with a consequence attached.

Name the channels in the requirement, not the capability. "Supports accessible alerting" is satisfied by a settings screen. A named channel with a named equivalent is not.
Make equivalence a test with a pass mark. Same information, same moment, same available action. A vendor demonstrates it or does not.
Require the co-design evidence. Who took part, at what stage, and what changed. No changes means no co-design took place.
Put the languages in the contract. The jurisdiction knows which languages it serves; the specification names them, and the translations are reviewed against the fixed wording rather than commissioned separately.
Measure it in the evaluation. Delivery and action rates broken out by channel, so that a channel nobody acts on is visible as a failure of the design rather than as a characteriztic of the people using it.
Refuse the fast-follow. An accessibility item moved out of the first release will be scoped as an addition to something already built, and by then the shape of the alert is fixed.

What this page does not fix

This is a design document and the honest close belongs here rather than in a footnote. Accessible alerting makes the system reach children it would otherwise have excluded. It does not widen what the system can see: the coverage limits are unchanged, and a child at risk from someone in their own household is no better protected by an alert they can now perceive. The two things are often confused in a hearing, and they should not be.

What this page does claim is narrower and worth holding. The design had two unexamined assumptions in it, both of them excluded people, and both were cheap to remove while the document is still a document. The Assessment's line is the whole argument and it does not need embellishing: a protective system that works less well for the children at highest risk has inverted its own purpose. Everything above is what it costs to avoid that, written down early enough to be affordable.

The requirements on this page derive from Part C, section C.4 of the Anchored Zone Assessment, 21 August 2026, and are recorded normatively as SP-116 to SP-121. The two-sided alerting design they modify is set out on the warning, tier and topology pages, and the evidence base for the alerting decisions themselves is the false-alert literature cited throughout this document [17][29][30]

How this works

1:06 · narrated · captioned · nothing here is sent anywhere when you press play. Prefer to read it? The transcript is below.

Transcript

At	Section	What it says
0:02	What it is	The specification assumed a sound reaches a child and an application reaches a guardian. Neither assumption was written down, so neither was ever argued.
0:11	Not a fallback	An audible alarm is not an alert. Haptic and visual must be equivalent, not secondary: the same information, at the same moment, driving the same next action.
0:22	Why secondary drifts	A channel defined as a fallback stops being tested first and loses the fields added later. Nobody notices, because the people testing the product hear the beep.
0:32	Designed with them	Alerting for children with cognitive and developmental disabilities has to be designed with them, not adapted afterwards. Adaptation makes the same alert louder.
0:42	The principle	A protective system that works less well for the children at highest risk has inverted its own purpose. That is a design principle, not a compliance note.
0:52	In the contract	So the clauses go in four places or none: the numbered specification, the acceptance test, the pre-registered evaluation, and the contract with a consequence.