Fable
The city warehouse and the order that it must not leave the city
A draft bank had many ledgers, usually kept in a warehouse at the east gate of the city. When the manager showed clients around, he would always point to the warehouse door and say, your ledgers are all in this city. Hearing this, clients felt reassured, believing these papers would never leave.
After the draft bank expanded, a cheaper warehouse was built in the outer city. With the rainy season approaching, the accounting office proposed moving part of the old ledgers there for backup. The manager thought there was no problem; after all, the original agreement had only said the ledgers were currently kept in this city, not that they could never be moved.
A client was very angry when he found out. His industry was regulated by the government, and the ledgers had to remain within the city's jurisdiction, with even backups and copies subject to the same constraint. Only then did the shopkeeper realize that showing a client the warehouse location and promising handling rules were two different things.
Later, the government issued a notice: certain tax and identity ledgers may not leave the city, and clerks handling these ledgers may only work in registered offices within the city. The draft bank could no longer fob things off with "currently in this city"; it had to prove that replication, backup, disaster recovery, customer service access, and outsourced processing all stayed within bounds.
Some customers only care where the ledger lives, for latency, audit and contractual ownership. They accept cross-city backups, requiring only that the primary database be located in a specified region and that the storage location be visible on the bill. For these customers, a residency commitment is already enough.
So the draft bank changed the sign. Each batch of account books indicated its current storage location, where copying was allowed, who could view it remotely, and whether it could be migrated in the event of a failure. If there was an order that it must not leave the city, they sealed off the transport route rather than just writing an address at the warehouse door.
When customers came again to ask, the shopkeeper first asked whether they wanted a location description or the legal and contractual retention constraints. Where the ledger sleeps today matters, but whether it can be moved, copied, processed, and accessed remotely is what determines whether the promise has teeth. The draft bank also added a migration map marking the main database, backups, transaction records, customer service workstations, and outsourced transcription points. Only after seeing it did customers realize that the ledger's route is much longer than the warehouse address. If migration scripts, monitoring copies, and manual troubleshooting are not on the map, the promise still leaks. Later, every time the warehouse changed, the draft bank checked the commands first, then the addresses and replication paths. Once the map was revised, the contract also had to be revised in sync, and audit evidence had to be kept complete for inspection.