Fable
The pharmacy's visitor register and the patient's prescription
There were two ledgers in the city's apothecary. One was the visitor register, recording names, addresses and the days they came; the counter assistant could fill it in, and it was kept in the front drawer. The other was the patient's prescription, recording pulse, symptoms, medicines used and dosage changes; only the seated physician could read it, and it was locked in an iron box in the back cabinet.
The new manager found it cumbersome. He leveled the standards of the two ledgers, locked them all in an iron cabinet, and required a written reason for retrieval. Daily operations at the pharmacy slowed down: when a customer wanted to return or exchange herbs, the purchase record had to be checked, and the clerk had to find the key, fill out a request, and wait for approval. Half an hour passed, and the customer cursed and left.
Trouble arose again when the seasons changed. The apprentice pharmacist did not know where the prescription book should go, and laid an old patient's prescription out at the front counter to fill it. A customer nearby happened to be from the same hometown, saw the illness on the prescription, and within three days the news had spread through the neighborhood.
The doctor called the steward over to the table. The visitor register also has value—if someone else got hold of it, they would know who visits the pharmacy often; but once prescriptions leak, what is harmed is a person's dignity, reputation and livelihood. Both must be managed, but the consequences are not on the same level.
The manager set new rules again. The register was placed in the counter's compartment drawer, locked but with the key at the counter, and access records were summarized once a week. The prescription book was stored separately, open only to seated doctors, and every consultation left a trace.
Once the new rules took shape, the pharmacy finally no longer went through half a day of trouble just to check an ordinary purchase record, nor exposed patients' private matters at the counter. Everyone realized that security investment should align with the consequences of a leak, not with the number of pages.
Later the chamber of commerce came to inspect. After going through both ledgers, they nodded: you did not treat a simple register as a cure for a terminal illness, nor treat a cure for a terminal illness as a register. Only then did the manager understand that the point of tiering is to first see which kind of consequence would truly cause harm.
Later, an even trickier job came along. On the surface it looked like just an old problem magnified, but in reality it forced out all the gaps hidden in the process: who takes over first, who can make changes, and how to return to the previous step when something goes wrong. Places that used to get by on acquaintances' tacit understanding now all had to be spelled out clearly.