Show the spot — and, with permission, help do it

A member of your group can ask NCraft to show something on the page: point at a spot or highlight an element. They can operate your browser — scroll, navigate, type, click — only if you allowed it. While anyone shows or acts, the top of the window says who it is and offers a Stop button.

What a member can do

• Without special permission — point at or highlight a spot on the page, and read that group's own data.
• Only if you allowed it personally for that person — see your open tabs and the current page's address.
• Only with your permission — scrolling, navigating, typing, clicking, writing on your behalf, logs.
• Dangerous rights (including access to files on disk) are off by default, granted to a specific member and need a typed confirmation. Even when granted, disk access never overwrites existing files and refuses network and system paths.
• Private tabs are never visible to anyone.
• Requests travel only inside your end-to-end encrypted groups; there is no remote access from the internet.

Rights

• 18 capabilities in three layers — screen, data, logs; each marked safe, careful or dangerous.
• The result is computed as: ceiling → rule for the member → rule for the group → group policy. A group policy (owner, admins) can only narrow rights, never hand them out.
• The rights popup: "My rules" and, for managers, "Group policy"; bulk buttons; logs have a level and an expiry.
• Your personal rules sync to all your devices.

Banner and Stop

• The "is controlling you / is showing you" banner: who, "What they did", "Stop".
• Stop lasts until the browser restarts; after that you're pointed to "Member rights".

Remote actions log

"Profile → Remote actions": who did what, and when. Kept on the device for 30 days (up to 2000 lines).

Logs

• "Log" — core logs by level and section. Secrets and keys are removed before anything is written.
• "Who sees my logs" — grant a person a level and an expiry.
• "Member's logs" — someone else's logs, never more detailed than granted.

Local ui-api — for programs on this computer

• Off by default. Once enabled after a warning it listens on 127.0.0.1:8790 only and requires a random 64-character token.
• Requests from web pages (with an Origin header) and with a foreign Host are rejected.
• Data within the same rights; never identity, keys or deletion.
• Screen actions show the same banner: "A program on this computer". Its Stop pauses the interface until restart.
• Turning the switch off closes the port; Forget identity deletes the token.