Fable
The Iron Lock and the Key Register
Sister Fang managed a large warehouse divided into north and south zones. She first installed good locks, then gave each worker a key. The gatekeeper only recognized keys: if the key was right, the door opened; if not, it was blocked. At first the warehouse became much quieter.
Half a year later something strange happened. Xiao Li transferred from the fabric section to the accounts office but still had the key to the south zone; the temp worker A Quan had left three months ago but his old key could still open the back door; the new supervisor needed to enter the north zone for inventory but no one knew which key to give him. The locks weren't broken; the key register was a mess.
Sister Fang first replaced the lock with a more expensive one. But an expensive lock still only judges whether a key is genuine; it does not know that Xiao Li's role has changed, nor does it remind anyone that A-Quan has left. When an audit came, the auditor did not look at the lock first, but asked: who can enter which door, who approves, how often is it reviewed, and who collects the key when someone leaves?
Only then did Sister Fang redo the key register. Each department listed the areas it needed to enter, and the person in charge confirmed quarterly; keys expired automatically, and renewal required a new stamp; on the day someone left, the gatehouse collected and deactivated keys according to the list. Exceptional entry required a written reason and time limit.
The warehouse did not change its locks again, yet many hidden dangers were reduced. The action at the door remained "verify the key, then let through," while the key register determined who should hold which type of key, and how those rights were issued, changed, and revoked.
Sister Fang later redid the key register: when a role changed, the keys changed with it; when a temp worker's term ended, the keys were automatically recalled; when a supervisor did inventory, only the inventory window and the corresponding area were granted. The gatekeeper still used keys to open doors, but the rules behind the keys were finally clear.
When the auditor reviewed, she looked at the key register first, then the door lock. A good lock can stop people without keys, but it cannot answer who should have keys, when they expire, or how temporary exceptions are approved. Only after Sister Fang separated these two things did the warehouse become truly secure.
Later, when the government project came up for acceptance, the auditor tried both the door lock and reviewed the key register. Sister Fang finally distinguished: the lock governs whether a single entry passes, while the key register governs where the rights come from, when they should change, and who is responsible. Focusing only on the door means missing the most dangerous changes in a permission's lifetime.