Three pieces of the same guardrail. The catalog a kid profile sees is filtered to MPAA G and PG. A PIN gate sits between a kid profile and the rest of the account. And deep links to anything outside that filter (bookmarks, shared URLs, the lot) are blocked at the route, so a clever URL can't walk past the picker.