# A shared tablet must not submit the previous user's work

Offline records need an account boundary that survives logout, reconnection and staff changes. Local possession of a draft does not establish current permission to submit it.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Follow a pending report through an account switch

Suppose a technician saves a report offline and signs out. A colleague then signs in on the same tablet. If the queue processor simply uses the current session, it may send the first technician's work under the second person's identity.

Partition local records by the application's organisation and account model. Bind queued commands to their original context and verify that context before sending. The server must still authorise the action against current permissions.

Do not use the presence of a cached job as proof that access remains valid. Assignments and permissions may have changed while the device was disconnected.

## Decide what logout does to unsent work

There is a real tradeoff between protecting a shared device and preserving its only copy of a report. Make the policy explicit before implementation. A warning might explain that work remains unsent and offer an approved handover, continued sync or deliberate discard.

Do not silently retain sensitive drafts in a form that the next account can browse. Equally, do not label a destructive cleanup as an ordinary sign-out action without making the consequence clear.

An authorised supervisor may need a transfer workflow for a departing worker. That should create a recorded ownership decision, not an impersonated retry with someone else's credentials.

## Minimise what the device carries

Download only the jobs and reference data needed for the agreed offline period. Large historical datasets increase exposure and storage pressure without helping the current visit.

Review photographs, customer contact details and free-text notes separately. The application shell cache and business-data store have different purposes and may need different cleanup rules.

Browser origin isolation is not a substitute for application account separation. Two users of the same application origin still need deliberate boundaries in the product's local data access.

## Test revocation at reconnection

Remove the worker's permission while the device is offline, then reconnect. Expect the server to reject unauthorised submission and the client to preserve an appropriate recovery state without endlessly retrying.

Record who can inspect, transfer or delete that pending work. Include device loss and shared-device return in the operating procedure. The review should end with a clear owner for unresolved data, not an assumption that logging out settled everything.

## Sources

- [MDN: IndexedDB](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API)