# Device networking access restrictions To prevent everyone from say, setting an air alarms mode to panic using their PDA for example, devices need some way to restrict who can send them packets. This should ideally be done using the access permissions we already have with id cards. An engineer or a head should be able to change the settings of an air alarm using devicenet if they have their ID inserted into their PDA. This should only be necessary for packets that get sent manually and for that packets should have a way of identifying if they are constructed by a player or not. ## The NetworkAccessRestrictionComponent & System This works like other connection components like the `WirelessNetworkComponent` or the `DeviceListComponent` in that it can prevent packets from being sent. In this case the `NetworkAccessRestrictionSystem` checks if the packet contains a `access_required` field that is set to `true`. If the packet contains such a field the system will call the `IsAllowed` method of the `AccessReaderSystem` with the entityuids of the sending and receiving entity. If access is not allowed the system will prevent the packet from being sent. Whether access was allowed or not gets sent as a response to the sending entity if the `access_required` field was present and set to `true`. The response uses the `cmd_access_response` command and the `access` field will contain `true` or `false` depending on if access was allowed or not. ## Gameplay intent Restricting who can send packets to manipulate certain devices using their ID means that you need to get your hands on the right permissions / ID to mess with devices that are access locked first. This prevents people from using devicenet for circumventing access restrictions. Traitors for example can steal the right ID and use it directly on the access restricted entity or spend the time to figure out the addresses & packet structure they need to do what they want over devicenet. Manual packages shouldn't be allowed to be broadcasted obviously and there should be a downside to using devicenet for manipulating access restricted devices outside of the higher complexity. One way to add a downside that gets other players involved is notifying certain roles (CE, Detective) on their PDA of manual packets that are sent to access restricted devices. Those roles can see the sent packet together with the name on the ID that was used for sending the packet and act if the packet does something nefarious. The UX for those notifications and packet logs needs to be good/easy enough to not discourage those roles from using them. ### The NetSecurity Cartridge This cartridge alerts the owner of any handcrafted packets that got sent that require access. This doesn't use device net but rather an event directly to reduce complexity and it either needs to be restricted per station or be proximity based. The cartridge comes preinstalled for detectives and sec officers.