Fable
The Messenger with the Seal
The South Market guild had many agents who picked up goods, advanced silver, and signed receipts for various proprietors. The accountant initially handled matters with a single passage token, relying on familiar faces and routes, and when the business was small, errors were rare. The accountant finally admitted that a passage token could only prove "there is a token," not who the bearer was, which house they represented, or whether they were still authorized.
Later, as there were more and more proxies, the wooden tokens were often lent out, and after being stolen they continued to be used to open cabinets. Once a wooden token was lent out or expired, the gatekeeper could not distinguish a legitimate proxy from an impersonator picking up goods; identity, subject, and authorization were mixed together, and errors naturally spread along the process.
The first patch was rushed: just station two more guards at the door, let anyone with a wooden token through, and stop anyone without one. Adding guards at the door only increased the queue; it did not prove that the token holder still represented the original shop. But new problems followed—everyone focused only on the most visible spot, while small deviations in the distance accumulated ever deeper.
They gave every agent a verifiable identity, bound credentials to subject, scope and validity period, and made them invalid immediately upon revocation; every pickup also left an authorization record that could be traced back.
The chamber of commerce made three changes: each wooden token was carved with its shop, valid date, and permitted matters; silver transfers required a reply from the shopkeeper; and voided tokens were posted on the blacklist the same day. This step was troublesome and at first slowed the work; but after a few rounds, rework decreased and the masters no longer changed rules on a whim. The chamber of commerce could finally verify identity, credentials, and authorization separately, and a growing number of agents didn't blur responsibility.
The new process asks a few more questions, but at last it can answer "who is doing what for whom"; once authentication and authorization decisions are separated, a stolen credential no longer automatically becomes the right to pick up goods.
One time an old employee came with an expired wooden token to collect silver and was stopped by the guard; only then did he discover he had long ago been dismissed by the original manager. From then on, the more people who could do the work, the more important it was to first ask clearly who he was, whom he was acting for, and by which rule he was taking action.