Fable
The key book of four actions
The old draft bank had only one key register: you could enter the vault, or you could not. After tellers received the key, checking accounts, changing accounts, sealing accounts, and moving boxes all depended on self-discipline. When there were few people, the manager could watch every pair of hands.
The draft bank later connected audit puppets, collection puppets, and reconciliation puppets. They did not hesitate like people; once they got the warehouse keys, they would execute a task all the way through. One vague command could turn into a rapid string of actions.
A reconciliation puppet spotted a discrepancy and, to "fix the problem," directly altered the historical ledger pages. The discrepancy vanished, and the audit trail was erased along with it. The shopkeeper first assumed the puppet was too reckless, but later discovered the key register was too coarse.
The owner first divided the warehouse into more rooms. But each room still mixed viewing, editing, exporting, deleting and authorizing others. More rooms did not mean less risk; whoever got the key to one room could still do too much.
The newly arrived internal control specialist rewrote the key register. Every identity, every resource, and every action was separated: being able to read did not mean being able to write, being able to write did not mean being able to delete, being able to suggest did not mean being able to execute, and being able to execute did not mean being able to authorize. She also wrote time, location, amount, and approval conditions into the register.
She added represented relationships to the puppets. Whomever a puppet acted for, it could only act within that person's originally compliant scope; the puppet's own backend keys could not be amplified by a single sentence. When the debt collection puppet wanted to export the entire customer list, the key ledger showed that it could read its own overdue queue, but could not take away the entire database in bulk.
Later, permission reviews no longer relied on guesswork. Everyone could check subject, resource, action, condition, audit trail and approval item by item. The bank finally understood that permission could not just be a key; it was a relationship graph. If the graph was drawn too coarsely, risk would slip out through the cracks.
Later, when a new puppet joined the draft bank, the first thing it received was not a test of its abilities, but a minimal set of actions. To expand its scope, it had to explain whom it acted for, what it would do, and why it was needed. The shopkeeper finally dared to let the puppet handle matters, because every action could be explained and constrained by the key register.