Column | Say More: I’m heartbroken my in-laws have chosen guns over grandkid visits

When a family conflict over firearm storage practices makes national headlines, it's easy to dismiss it as a cultural or political story. But as a software engineer who has spent years building access-control systems for cloud infrastructure, I see something else: a textbook failure of identity and authorization policy. The Washington Post column describes a heartbroken parent who refuses to let their children visit grandparents until a gun safe is installed. The grandparents have "chosen guns over grandkid visits. "

The core tension here isn't about politics-it's about a fundamental mismatch in threat models and access-control enforcement between two parties. In engineering terms, the grandparents are running a system with no authentication layer, no audit log, and no revocation mechanism for a highly sensitive resource. The parent is demanding a mandatory access control (MAC) policy. This isn't just a family drama; it's a case study in how we design, communicate. And verify safety policies in both physical and digital systems.

Let's unpack this through the lens of systems engineering, observability, and policy-as-code. We'll examine the technical parallels, the failure modes. And what a robust implementation of "gun safety" looks like when you treat it as a security control rather than a moral stance.

The Threat Model: Unauthorized Access to a Privileged Resource

From a security engineering perspective, a firearm in a home with children is a resource that must be protected against unauthorized access. The threat actors are curious children, their friends. Or even a malicious visitor. The grandparents' current configuration-no safe, no lock-is equivalent to running a production database with a default password and no firewall. The parent's demand for a gun safe is a request for a mandatory access control (MAC) system.

In enterprise environments, we enforce access control through role-based access control (RBAC) or attribute-based access control (ABAC). For a gun safe, the closest analog is a physical access control system (PACS) with a PIN, biometric. Or key-based mechanism. The grandparents' refusal to implement this control is a denial of a basic security requirement. In my experience deploying identity platforms, the most common failure is not technical capability but policy acceptance-stakeholders refusing to adopt a control because they perceive it as inconvenient or distrustful.

The parent's threat model is correct: children under 12 have limited impulse control and are naturally curious. Data from the CDC (2023) shows that nearly 4. 6 million children live in homes with at least one unlocked, loaded firearm. This is not a theoretical risk-it's a quantifiable probability. The grandparents' threat model, by contrast, prioritizes convenience and personal autonomy over child safety. This mismatch is the root cause of the conflict.

Policy-as-Code: Translating Family Rules into Verifiable Controls

In DevOps, we use policy-as-code tools like Open Policy Agent (OPA) or HashiCorp Sentinel to define rules that are automatically enforced and audited. The parent's demand is effectively a policy rule: "No children shall be in the presence of an unsecured firearm. " This rule must be codified into a control-a gun safe-that can be verified.

The grandparents' objection ("It's my home, my rights") is analogous to a developer pushing code that violates a compliance policy and arguing that the policy itself is illegitimate. In a well-governed system, policy violations block deployment. Here, the parent is enforcing the policy by withholding the "deployment" of their children. This is a form of circuit breaker-a safety mechanism that prevents harm when a precondition isn't met.

What's missing is a verification mechanism. The parent can't remotely audit whether the safe is installed and used correctly. In cloud infrastructure, we use configuration management tools like Chef or Ansible to ensure compliance. For a gun safe, the parent would need a trusted third-party verification-perhaps a photo, a video call. Or a tamper-evident seal. Without observability, trust is blind,

Observability and Audit Logging: The Missing Piece

Even if the grandparents install a gun safe, how does the parent know it's being used correctly? This is where observability comes in. In SRE, we define service level objectives (SLOs) and monitor them with metrics, logs. And traces. For a gun safe, the SLO might be: "100% of firearms are stored in the safe when children are present. " The metric is binary-safe locked or unlocked.

Modern smart gun safes from brands like Vaultek or SentrySafe offer digital logs of access events, including timestamps and user IDs. Some even support Bluetooth or Wi-Fi connectivity, allowing remote monitoring. If the grandparents install such a device, the parent could receive a push notification every time the safe is opened. This is the equivalent of an audit log in a SIEM system.

Without this observability, the parent is relying on self-reporting-a notoriously unreliable data source. In my work building observability pipelines, I've learned that humans consistently overestimate their own compliance. The only way to close this trust gap is through automated, verifiable data. The grandparents' refusal to provide this data is a red flag, similar to a developer refusing to enable logging on a critical service.

Identity and Access Management (IAM) for the Home

A gun safe is essentially an IAM system for a physical resource. The safe defines who (identity) can access what (the firearm) under which conditions (time of day, presence of children, etc. ). The grandparents are the resource owners, but the children are the subjects who need to be protected from unauthorized access.

In a well-designed IAM system, you would implement the principle of least privilege: only the grandparents should have access to the safe. And only when children aren't present. This could be enforced with a biometric lock that only recognizes adult fingerprints. Or a keypad code that's changed after each visit. The parent's demand is essentially a request for multi-factor authentication (MFA) on firearm access.

What's interesting is that the grandparents are treating the firearm as a personal possession rather than a shared risk. In cloud security, we talk about the shared responsibility model-the cloud provider secures the infrastructure, but the customer secures their data. Here, the grandparents are the infrastructure provider. And the parent is the data owner (the children). The grandparents' refusal to implement a control is a violation of their responsibility to secure the environment.

The Human Cost of Policy Violations: A Systems Failure

Let's step back from the technical analogy and acknowledge the emotional toll. The Washington Post column describes a parent who is "heartbroken" that their in-laws have chosen guns over grandkid visits. This isn't a theoretical debate; it's a real family torn apart by a policy disagreement. In engineering terms, this is a failure of incident response and crisis communication.

When a security incident occurs-like a data breach or a near-miss with a firearm-the first step is to contain the damage and then conduct a root cause analysis. Here, the "incident" is the grandparents' refusal to implement a control. The parent's response (withholding visits) is a containment measure. But without a shared understanding of the threat model, the containment becomes permanent.

I've seen similar dynamics in organizations where security teams impose policies without explaining the risk to business stakeholders. The result is shadow IT, resentment, and eventual policy violations, and the solution is education and empathyThe parent could explain the risk using data: "According to the CDC, 1 in 3 homes with children and firearms have at least one unlocked gun. That's a 33% chance of a preventable tragedy. " But data alone rarely changes minds-it must be paired with a trusted relationship,

Technical Solutions for a Human Problem: Smart Safes and API Integration

If we treat this as a systems engineering problem, the solution is a smart gun safe with API access. Companies like Vaultek produce safes that can be controlled via a mobile app, with features like biometric unlock, tamper alerts. And access logs. These devices expose a REST API that could theoretically be integrated into a home automation system or a third-party monitoring service.

Imagine a scenario where the parent installs a Vaultek safe in the grandparents' home, configures it to send a webhook to a serverless function (e g., AWS Lambda) every time the safe is opened. And receives an SMS alert. This isn't science fiction-it's a straightforward integration using existing tools. The parent could even set up a conditional access policy: if the safe is unlocked for more than 5 minutes while children are present, trigger an automated phone call to the grandparents.

Of course, this requires the grandparents' consent and cooperation. But it reframes the conflict from a moral standoff to a technical negotiation. The parent could say: "I'll trust your safe if you let me verify it through this app. " This is the same logic used in zero-trust networking-never trust, always verify.

Lessons from Incident Response: What to Do When Policy Fails

When a policy can't be enforced, the incident response plan must kick in. In this case, the parent has already initiated the response: isolate the children from the threat. But this is a temporary fix. The long-term solution requires either policy compliance (the grandparents install a safe) or threat elimination (the grandparents remove the firearms from the home).

In my experience, the most effective incident response includes a post-mortem. The parent could invite the grandparents to a conversation where they review the risk together, using data from the CDC or the National Safety CouncilThe goal isn't to blame but to align on a shared objective: protecting the children. This is analogous to a blameless post-mortem in SRE, where the focus is on system improvements rather than individual fault.

If the grandparents still refuse, the parent may need to escalate-perhaps involving a family therapist or a mediator. In software, when a team can't agree on a security policy, the issue is escalated to a security architect or a CISO. Here, there's no higher authority. So the parent must enforce the policy unilaterally. It's painful, but it's the right call from a risk management perspective.

The Role of Technology in De-escalating Family Conflicts

Technology is often blamed for creating distance in relationships, but it can also bridge gaps. A shared dashboard that shows the status of the gun safe-locked or unlocked-could transform a trust issue into a data-driven agreement. Services like IFTTT or Home Assistant can integrate smart safes with other home automation systems, creating a unified view.

For families that aren't tech-savvy, simpler solutions exist: a mechanical safe with a combination lock that the parent knows. Or a safe that's bolted to the floor and requires two keys. The key is to move from an abstract demand ("get a safe") to a concrete, verifiable specification ("a safe that meets ASTM F2648-20 standard for gun safes, with a lock that can't be bypassed by a child").

This is the same approach we use in engineering requirements: define the acceptance criteria, then test against them. The parent could write a simple checklist: (1) Safe is anchored to a stud, (2) Lock requires a key or code that the child doesn't know, (3) Safe is closed and locked when not in use. If the grandparents meet these criteria, the visit can proceed, and if not, the circuit breaker stays engaged

FAQ: Common Questions About Gun Safety and Technology

Q: Are smart gun safes secure against hacking?
A: Most consumer smart safes use Bluetooth or Wi-Fi with encryption (AES-128 or AES-256). However, any connected device introduces an attack surface. For maximum security, a mechanical safe with a high-quality lock is preferred. The key is to choose a safe that has been independently tested, such as those certified by Underwriters Laboratories (UL).

Q: Can a child bypass a biometric gun safe?
A: Some biometric safes have been shown to be vulnerable to spoofing using printed fingerprints or gelatin molds. Higher-end models use multi-spectral sensors that detect blood flow, making spoofing harder. For child safety, a combination lock or key lock is often more reliable than budget biometrics.

Q: What is the best way to verify that a gun safe is being used?
A: The most reliable method is a smart safe with remote monitoring. Failing that, a simple tamper-evident seal (like a plastic zip tie) on the safe door can indicate whether it has been opened. Regular video calls or in-person inspections are also effective.

Q: How does the risk of an unlocked gun compare to other child safety risks?
A: According to the CDC, firearms are the leading cause of death for children and teens in the U. S. (2020 data). The risk of accidental firearm injury is comparable to drowning for children under 10. A gun safe reduces this risk by over 80% when used consistently.

Q: Is it reasonable to demand a gun safe in someone else's home?
A: From a risk management perspective, yes. As a parent, you have a responsibility to control your child's environment. If you can't control the environment, you must control access to it. This is the same logic used in workplace safety: you can refuse to work in an unsafe environment without retaliation.

Conclusion: Building a Safer System, One Policy at a Time

The Washington Post column captures a deeply human conflict. But the underlying mechanics are pure systems engineering. The parent is enforcing a policy that the grandparents refuse to add. The solution isn't to shame either party but to design a system that satisfies both threat models: the grandparents' desire for autonomy and the parent's need for safety.

Technology can help, but only if both parties are willing to adopt it. A smart gun safe with an audit log is a tool, not a cure. The real work is in the conversation-explaining the risk, agreeing on a control. And verifying compliance. This is the same work that security engineers do every day,, and and it's never easyBut it's always worth it.

If you're a parent in this situation, start by researching safe options and presenting a specific proposal to your family. If you're a grandparent, listen to the data and consider how a simple change can protect the people you love. And if you're an engineer, think about how you can build better tools for this kind of conflict resolution-because the stakes are higher than any production outage.

What do you think?

Should parents have the right to demand safety controls (like gun safes) in homes where their children visit,? Or does that overstep the homeowner's autonomy?

Is a smart gun safe with remote monitoring a reasonable compromise,? Or does it create new privacy and security risk that outweigh the benefits?

How can software engineers design better tools for families to negotiate and verify safety policies without relying on trust alone?