Loader Mode vs Admin Mode: Weighing Scale App User Roles That Protect the Money
The man on the scale needs the weight. He does not need the rate.
That one sentence is the whole design of a well-built weighing app. The loader at the crate, the packer at the label station — each needs a live reading, a way to record it, and nothing else. The rate, the bill and the payment belong to the owner. Weighing scale app user roles are how one phone serves both people without either seeing what he should not: a loader mode that shows weights only, and an admin mode behind the owner’s PIN that holds the money. Here is what each role sees, why it counts as a fraud control, and how to start in thirty days.
One phone, two people, two screens
Hindustan Scale Company (HSCo) builds its connected scales and the Android apps beside them, and the same split appears in two different businesses.
On a broiler farm, the poultry app keeps two accounts on one phone. In Loader mode the man at the crate sees the live weight from the Bluetooth platform scale, taps to record each crate and builds the morning challan — weights, counts, the trader’s name, the time. No rate. No bill. No payment status, on any screen he can open. Behind a Super Admin PIN sits the owner’s side: the rate is added in the evening, the invoice is raised from the challan, and the record moves from payment pending to received.
On a textile packing line, an HSCo packet-weighing station splits the same way: the operator’s screen weighs, counts and prints the label; printer, page and connection settings live on separate installer screens with their own manual.
| Loader / operator | Owner / admin (behind the PIN) | |
|---|---|---|
| Live weight from the scale | Yes | Yes |
| Record a weighment, build a challan | Yes | Yes |
| See the rate or the value of a load | No — the field is not on his screens | Yes |
| Raise, correct or cancel a bill | No | Yes — with a reason and the PIN |
| Reports, exports, scale and printer settings | No | Yes |
The rate is not greyed out for the loader; it is absent. And the owner does not get a second phone — he gets a second door in the same one.
Why are weighing scale app user roles a fraud control, not a convenience?
Because the internal-control standards say so, in almost these words.
The US Government Accountability Office’s Green Book (GAO-25-107721, 15/05/2025) puts it plainly: management “divides or segregates key duties and responsibilities among different people to reduce the risk of error, misuse, or fraud … so that no one individual controls all key aspects of a transaction”. NIST SP 800-53 says the same control “helps to reduce the risk of malevolent activity without collusion”. The loader has custody of the birds and presses the weigh button. The owner sets the price and raises the bill. That is the standard’s split, drawn as two screens.
The narrower rule is least privilege — NIST’s “only authorized accesses … necessary to accomplish assigned organizational tasks” — and the OWASP Application Security Verification Standard 5.0 (2025) asks for it at two depths: which functions a person can open, and which fields he can see. A loader who sees the weight but not the rate is field-level authorisation in the standard’s own vocabulary.
The Association of Certified Fraud Examiners’ 2026 Report to the Nations, a study of 2,402 cases in 143 countries, estimates that organisations lose about 5 % of revenue a year to occupational fraud, with a median loss per case of about ₹99 lakh (USD 104,000), and that businesses with fewer than 100 employees are hit hardest, at about ₹1.2 crore (USD 126,000). Treat those as one publisher’s estimates. But its finding on controls is the point: more than half of its cases came down to a control that was missing (33 %) or overridden (19 %), and where a control was in place the median loss was about a third lower.
The Green Book also answers the small-business objection. Where there are too few people to split duties, it says design an alternative control — a review step, a record of who did what. A PIN and a history are exactly that.
The scale’s own rulebook already asks for a PIN
Role separation did not come from app makers. It is older than the phone.
OIML R 76-1, the international recommendation for weighing instruments, calls the settings that can change a reading — span, capacity, units, decimal position — “device-specific parameters”; its accepted solution is that they “should only be changed by an authorized person via a special PIN-code”, with an audit trail of every intervention kept until the next verification. The European software guide WELMEC 7.2:2023 adds that each entry carries the parameter’s name, its value and a time stamp, and “cannot be deleted or be changed without destroying a seal”. OIML D 31:2019 adds the person’s identity.
The same documents draw a second line. The weighing result and the parameters behind it are the “legally relevant” software; anything that repeats or further processes the reading — a printer, a PC, a phone app — is a “peripheral device”, which may never influence it. So the loader’s screen mirrors the verified reading, the rate and the invoice live across that line, and the app’s roles keep the two apart for people the way the standard keeps them apart for software.
India’s law sits on the instrument side of that line. Under the Legal Metrology Act 2009 every weight or measure used in trade must be verified and stamped before use (s.24); using an unverified one draws a fine of ₹2,000–₹10,000 (s.33); tampering with a verification stamp carries at least six months’ imprisonment (s.44). The Act polices the scale. The roles police the layer it does not — who may see and change the rate, cancel a bill or edit a record — so the history can show that nobody touched the weighed quantity between the stamped display and the invoice.
How strong is a short PIN between two people at one phone?
On its own, not very. With the right company, strong enough.
Two peer-reviewed studies of real PINs agree. Bonneau, Preibusch and Anderson (Financial Cryptography, 2012) found that three guesses open about 9.2 % of phone unlock codes — against 0.03 % if the codes were random — and that “1234” alone was 4.3 % of one large set. Markert and colleagues (ACM Transactions on Privacy and Security, 2021; 1,705 participants) found that with only 10, 30 or 100 tries allowed, a six-digit PIN gives “little to no increase in security” over a four-digit one.
The lesson is not “make it longer”. NIST SP 800-63B-4 (26/08/2025), the US guidance for a local PIN, asks for at least four characters and preferably six, permits an all-numeric code, wants obvious choices such as 123456 blocked, and, above all, allows no more than 10 consecutive wrong attempts before the authenticator is disabled. A PIN on a shared phone is as strong as three things it is not: a limit on attempts, a record of every attempt, and the other controls around it.
The controls around the HSCo owner PIN look like this. Money-changing actions — cancelling or correcting a challan or a bill — ask for a reason and the admin PIN even inside an open owner session: OWASP’s mobile standard calls this securing “sensitive operations with additional authentication”. A wrong PIN on such an attempt is itself recorded. Every correction keeps the original entry beside the change. And the app warns the owner when no admin PIN has been set, because a lock that is never fitted protects nothing.
What role separation is not
It is not distrust of the loader. A man who cannot see the rate cannot be accused of leaking it, cannot be pressed by a trader to “adjust” a bill he has no power to touch, and cannot be blamed for a correction the history shows he did not make. The split protects him first.
It is not a retail-counter design. On a price-computing scale used for direct sale to the public, OIML R 76-1 requires weight, unit price and price to pay to be shown and printed together. Role separation is for business-to-business records — weighed at dawn, priced at dusk — not for the price-computing scale at a shop.
It is not a lock on the phone. Android’s own documentation offers separate user profiles and a kiosk-style lock mode, but one is off by default and the other needs a device-policy app; the in-app split works on the phone you already own.
It is not proof against collusion. The Green Book says plainly that two people can agree to override it. What the split does is make every override leave a mark.
And it is not the legal weight. The stamped scale is the instrument; the phone mirrors what it showed and keeps the record.
What changes on Monday morning
- The rate stays in the office. A borrowed phone at the loading bay does not put your price list into circulation.
- The loader’s day gets simpler. One screen, the weight and the record; no settings he can change by accident.
- Every bill has a chain. Challan by the loader, rate by you, invoice, payment pending, received — each step with a time and a person.
- Corrections stop being arguments. The original entry stays beside the change and its reason; a wrong PIN on a cancel attempt is on the record too.
- The record can go on to the office. Challans and invoices are ready for the data logging and reports side when you want them.
How to start: one phone, one loader, thirty days
- Pick one scale and the person who weighs on it most — the loader on a farm, the packer on a line.
- Set the owner PIN before the first weighment — not one of the obvious choices — and keep it to the people who price and approve.
- Weigh in loader mode for a month; price, bill and settle in admin mode.
- At the end, read the history: every correction, its reason, every wrong-PIN attempt. An empty list is a control that cost nothing; a full one is what no diary would have shown you.
- Extend it to the next scale only when the record has earned it.
Hindustan Scale Company has made weighing scales in Mumbai since 1955 and builds the Bluetooth-enabled scale, the app and the owner-side controls itself — one supplier answers for the whole chain. The wider range is on the IoT connected weighing scales page.
Frequently asked questions
What are user roles in a weighing scale app?
They are separate accounts on one phone that open different screens. A loader or operator role shows the live weight and lets the person record weighments and build a challan; an owner or admin role, behind a PIN, holds the rates, bills, payments, reports and settings. Each person sees only what his job needs.
Can the loader see the rate or the bill in loader mode?
No. The rate field, the invoice and the payment status are not on any screen the loader can open — they are absent, not hidden behind a menu. He weighs, records and raises the challan; the owner adds the rate later on the admin side.
What happens if someone enters the wrong owner PIN?
The action does not go through, and the wrong attempt is recorded, so the owner can see that someone tried to cancel a bill or change a rate, and when. That record, not the refusal alone, is what security guidance such as NIST SP 800-63B-4 and the metrology audit-trail rules are asking for.
Is a short numeric PIN safe enough for the owner screens?
Research on real PINs shows the length matters less than the rules around it: with only 10 to 100 tries allowed, a six-digit PIN is barely safer than a four-digit one. What protects the owner screens is the attempt limit, the record of every attempt, a PIN that is not one of the obvious choices, and the history of corrections behind it.
Does role separation change the legal (stamped) weight?
No. Under the Legal Metrology Act 2009 the verified and stamped scale is the legal instrument, and the weight it shows is the legal reading. The app mirrors that reading and keeps the record; the rate and the bill live on the non-legal side, which is exactly why they can sit behind a PIN.
Does this work on a shop counter that sells by price?
Not in the same way. A price-computing scale for direct sale to the public must show and print the weight, the unit price and the price to pay together — the buyer is entitled to see all three. Loader and admin roles are for business-to-business records, where the weight is taken first and priced later.
Next step
Tell us who weighs and who prices in your business, and we will set up a thirty-day one-phone pilot with a loader role and an admin role.
Hindustan Scale Company (HSCo) · Mumbai · est. 1955 · www.hindustanscale.com · hsc@hindustanscale.com
Sources
- US Government Accountability Office — Standards for Internal Control in the Federal Government (Green Book), GAO-25-107721 (15/05/2025): Principle 10 attributes, paras 10.21–10.23 on segregation of duties and alternative controls.
- NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations (OSCAL catalog v5.2.0, 2026): controls AC-2, AC-5, AC-6, AC-6(9), AC-7, AU-2, AU-9.
- OWASP — Application Security Verification Standard 5.0.0 (May 2025), V6, V7, V8 and V16; Mobile Application Security Verification Standard v2.1.0 (18/01/2024), MASVS-AUTH-2 and AUTH-3.
- Association of Certified Fraud Examiners — Occupational Fraud 2026: A Report to the Nations (14th edition): Key Findings, Figures 28, 30 and 37, Regional Focus: Southern Asia (single publisher; rupee equivalents at ECB reference rates of 14/09/2026).
- OIML R 76-1:2006 — Non-automatic weighing instruments, Part 1: clauses T.2.3.5, T.2.8.1, T.2.8.4, T.2.8.7, 4.1.2.4, 4.14.3 and 5.5.2.2.
- OIML D 31:2019 — General requirements for software controlled measuring instruments: clauses 3.1.1, 3.1.17, 3.1.52, 6.1.3.2.1, 6.1.3.2.4, 6.2.2.2 and 6.2.8.5.
- WELMEC Guide 7.2:2023 — Software Guide (Measuring Instruments Directive 2014/32/EU): requirements P7, S1, S3 and L2.
- NIST SP 800-63B-4 — Digital Identity Guidelines: Authentication and Authenticator Management (final, 26/08/2025): Secs 2, 3.1.1, 3.2.2, 3.2.8 and 3.2.10.
- Bonneau J., Preibusch S., Anderson R. — “A birthday present every eleven wallets? The security of customer-chosen banking PINs”, Financial Cryptography and Data Security (2012), Table 1 and Sec. 4.2.
- Markert P., Bailey D. V., Golla M., Dürmuth M., Aviv A. J. — “On the Security of Smartphone Unlock PINs”, ACM Transactions on Privacy and Security 24(4) (2021), extended from IEEE S&P 2020.
- The Legal Metrology Act, 2009 (Act No. 1 of 2010) — India Code, Government of India, ss. 2, 24, 26, 30, 33 and 44; cross-checked on Indian Kanoon.
- Android Open Source Project — Multi-user support (13/07/2026); Android Developers — Lock task mode (05/03/2026); European Central Bank — euro foreign exchange reference rates (14/09/2026).
- Hindustan Scale Company — IoT Connected Weighing Scales page; poultry weighing app (loader / admin roles); packet-weighing label station (operator / installer screens).