A Demo Three People Can Use Without Training

The engineering dashboard I use to test lights is completely wrong for a salesperson standing in front of a customer. Dense, technical, full of raw values. It does its job — for me.

So I built a second one.

Same hardware, different product

The sales demo drives the same lighting rig from the same controller. But it’s a different surface with a completely different job: a person who’s never seen this system needs to turn the lights on, dim them, run a scene, and show the customer a number that looks like a real number — in front of that customer, without looking like they’re reading a terminal.

The hard constraint was isolation. The demo publishes to a deliberately tiny slice of the command surface. It cannot reach the raw command topic, and it can’t touch the engineering app’s state. Someone fumbling a slider in front of a customer must not be able to reset a module and rewrite its operating hours.

Access control as a product decision

• One person holds the rig at a time. A lease, not a login queue.
• The lease releases itself if the holder goes idle.
• A hard rate limit on how fast commands can be issued — not to protect the hardware, but because a fast human mashing buttons is a bug that should be visible, not a feature.
• Every command is written to an append-only log, so “who dimmed it and when” always has an answer.

And a mock mode: a simulated rig with realistic sweep delays, occasional faults, and lights that go offline. Used for training when the real rig is down, and for rehearsing the demo without touching live hardware.

The lesson that was not about lock-in

The first version had a login. It was technically correct and practically dead — the password was remembered by nobody and typed wrong by everyone, so the demo started with a small humiliation before it started with a product.

The second version dropped the login entirely. It keeps the presenter lock, the rate limit, and the audit trail, which are the parts that protect the rig. It drops the part that only protected the database.

Authentication is not the same thing as access control, and a demo for a human being needs the second one much more than the first.

The rule I’d write on the wall

Every restriction is either enforced by the absence of a code path, or it isn’t enforced. The demo has no code that can publish a raw frame. Not a permission check — no path at all. “We don’t do that” is a much stronger claim when there’s nothing to disable.