Fable
The warehouse gate that reads weather and identity
The princely storehouse no longer issued keys solely by official rank, because the same rank came with different intentions. At first the storehouse officer acted based on person, item, time, and reason—familiar people and familiar routes meant few errors when the days were small. The storehouse officer found that job titles were too coarse: whether the same person could open the door depended on who he was, what he wanted to see, when he came, and whether he had a current assignment.
Later, some people could check the grain ledger during the day but should not open the silver cabinet at night; some could view the East Warehouse but not touch the West Warehouse. Fixed job-based keys cannot express temporary tasks, time windows and resource scope; when conditions change, overly broad permissions spread along shared keys.
The first fix was rushed: each position was given only a fixed set of keys, and every task change required re-cutting a set. Reassigning fixed keys by position looked tidy, but could not express temporary tasks, time windows, or resource scope. Yet new problems followed, and everyone stared only at the most visible places while small deviations in the distance piled up.
They write the subject, resource, action, environment, and reason as attributes, have the policy combine and judge them at the moment of the request, and record the rules hit and the reason for denial.
The warehouse official switched to checking waist tokens, dispatch orders, warehouse category, time, and accompanying person—only when several matched would the door open. This step was troublesome and initially slowed the schedule; but after a few rounds, rework decreased, and the craftsmen no longer changed rules on a whim. The door-opening decision finally varied with subject, resource, action, and environment, and every judgment left an auditable reason.
From then on, 'can this door be opened' was no longer a permanent perk of a position, but a precise judgment of current conditions; attribute policies both reduced over-authorization and preserved audit trails.
One night, a grain management official wanted to withdraw silver. His rank was high enough, but the reason and the vault category didn't match, so he was stopped at the door. From then on, authority was not judged only by the person's name, but also by what he wanted to move under what conditions.