Everyone on the same vessel. Everyone on the same page.

A forty-foot-plus boat is rarely a one-person operation. There is an owner who may not be aboard, a captain who runs her, a mate, a manager, a yard, and guests who just want to know where the towels are. They should not all see the same thing — and they certainly should not all be able to change the same thing.

Five roles, ordered

The order is deliberate and it is enforced in the code rather than in the interface: a role cannot grant an authority it does not itself hold. Hiding a button is not access control; theONE gates the action, then hides the button so nobody is offered a door that would refuse them.

The vendor is not a junior crew member

This is the part most systems get wrong. A mechanic needs to see the engine's service history and record what he did. He does not need your crew's private notes, your insurance documents, your guest list or your float plans — and giving him a low-privilege crew login hands him all of it.

So a vendor in theONE sits outside the role hierarchy and inherits nothing from it. Their access is granted per card, by explicit permission, for the work in front of them. They get a work session, they record against it, they sign off — and the record of what they did stays attached to their card afterwards.

A yard should be able to prove what it did without being able to read what it wasn't asked about.

Temporary authority, with an expiry

Real boats need exceptions. The captain needs to edit something normally reserved to the owner while the owner is on a plane. theONE handles that as a grant with an expiry rather than a permanent promotion — the elevation is recorded, it is visible, and it lapses on its own. Nobody has to remember to take it back, which is the step that never happens.

Private notes stay private — and reads are logged

Crew can keep notes that are theirs. An owner has a legitimate override, because it is ultimately the owner's vessel — but exercising it is recorded. If somebody's private note is read by the owner, that read is in the trail.

That cuts both ways on purpose. It means crew can write candidly, and it means an override is a deliberate act with a record rather than a silent capability.

The Crew Book — people, not memberships

Over a few seasons you sail with the same people again and again: a relief captain, two mates you trust, the chef who does the summer, the delivery skipper. The Crew Book is your own card file of them — name, photo, contact, maritime details, notes, and the role you would normally give them.

The distinction that makes it work: a card is not access. Having someone in your Crew Book grants them nothing. A card only becomes a membership when you deliberately invite that person to a vessel — and then the two are linked in both directions, so you can walk from a member back to the card they came from. Adding a known mate to next week's trip is one tap instead of retyping an email address for the fifth time, and it never accidentally hands anybody a key.

The Ships Directory — one place to find a person

Crew, guests, vendors, float-plan contacts and emergency contacts, in one home with a single search field across all of them. When you need the number for the yard, or the shore contact on last month's float plan, you should not have to remember which part of the app that person lives in.

And the Directory owns almost nothing. Every row is a door to the canonical card that already exists elsewhere — the emergency list is a projection over contacts stored on crew and guest cards, not a second copy that can drift. Anyone in the directory who is actually a theONE member carries a teal star, and that badge is read from the real membership link rather than a toggle somebody has to remember to set. One truth, many doors: the same rule the whole app is built on.

More than one boat

Own or run a second vessel and a Fleet view appears — a grid of vessels with the active one ringed, a summary on each, and a tap to switch. Each boat is a completely separate record: her own trips, her own systems, her own crew, her own documents. Nothing bleeds across.

You can switch from the Fleet grid, from the vessel name in the Mission Control header, or from your launch preference, and every route works in both directions so there is never a dead end. And if you only have one boat, none of this appears at all. A single-vessel owner should never pay in screen space for a feature they do not use.

Boat IT — the small keys

Wi-Fi passwords, marina gate codes, the chartplotter's admin login, the account the bilge alarm texts. The unglamorous credentials that run a modern boat and that otherwise live on a scrap of paper at the helm or in one person's phone. Face ID locked, one search away, and shared with the people who need them rather than the person who happened to set them up.

Guests

Guests get what guests need — where things are stowed, what is happening today — and nothing else. A guest looking up which locker the towels live in should not be a reason to hand out an account that can see maintenance costs.

Why it is built in rather than bolted on

Because access control added later is always cosmetic. The moment a second person touches the boat's record, the questions “who can change this” and “who has seen this” stop being administrative and start being part of what the record means.