A tablet handed to the next shift may still contain the previous person’s work. The operating system can successfully isolate its messenger from other apps while leaving both people able to open the same messenger session. That is not a contradiction. Application isolation and separation between human users solve different problems.
An application identity is not a person’s identity
The Android Open Source Project explanation of the application sandbox describes how app identities and kernel-enforced boundaries separate applications. Its purpose is not to recognise which colleague is currently holding an unlocked device. The fact that another ordinary app cannot read a messenger’s private files does not establish that a second person cannot use its visible interface.
Consider a hypothetical shared service tablet. Two employees use one operating-system user, one installed application and one logged-in account. The application has no reason to infer a change of person merely because the device changed hands. A handover policy needs an explicit transition: locking, switching to a separately protected context or ending the previous authorised session.
Users, profiles and accounts are distinct concepts
AOSP’s documentation for multiple users distinguishes physical users, profiles and application accounts. It describes separated app data for users and explains that manufacturer configuration affects which user features a device exposes. An account inside an app is not automatically a separate operating-system user.
A visible “switch account” button therefore needs inspection. Does it create independent storage and independent access control, or just change which inbox is displayed? Is the previous archive still searchable? Does returning to the old account require renewed authorisation? These are product-specific questions. Their answers cannot be read from an operating-system feature list.
Stored encryption still needs an application-state test
The UseCrypt Messenger explanation of local records and keys separates copied database files from readable content in a running application. That is the relevant starting point for shared-device analysis. It is not evidence that the product supports multiple independent human users within one app installation.
A document about encryption at rest can explain why an archive copied from storage requires more than its bytes. It does not automatically explain what the next authorised holder of the device can see. The handover test must name the state of the screen, the application and the account. Otherwise “the device was locked” can conceal several incompatible starting conditions.
Specify what should survive a handover
Some shared workflows intentionally preserve a common operational history. Others require strict personal separation. Neither policy should be silently inferred from the cipher. The organisation needs to decide whether a shift successor should see old messages, just new work or no prior account data at all.
That decision also affects support and accountability. A shared account can make it difficult to attribute an action to a particular person. Introducing individual accounts may improve attribution, but it does not prove that old local material disappears on sign-out. The expected retention and access rules should be written before a test declares success.
Rehearse the transition with synthetic records
Use two test identities and non-sensitive messages in an authorised environment. Record the exact device build, app version and supported account model. Perform the intended handover, then check the previous inbox, search results and export paths from the successor’s context. Repeat after restarting the application so an accidental temporary screen state is not mistaken for durable separation.
If the device does not offer the required separate-user feature, record that limitation rather than assuming every Android device has it. If the application supports only one account, test that actual design instead of inventing a multi-account mode. A credible deployment explains who may use the same physical device and which boundary changes when it changes hands.
