Fable
The steward issued registrable external craft badges to the clerks
Qingshi Trading had a clever ledger boy who could answer price questions, explain contracts, and remind the shopkeeper which letters to reply to. But he could only speak at the counter; to actually check shipping schedules, place purchase orders, or change account books, different clerks had to be called.
At first, the shopkeeper had the ledger boy write the steps out for people to see. When a customer asked about returns, he said to first go to the warehouse, then to the accounting office, then get a red seal. The words were clear, but the matter still required a person to run around. Customers grew impatient, and the clerks also disliked the extra layer of message-passing.
Later, the carpenter made several pluggable small boxes: one connected to the warehouse tag, able to check goods; one connected to the accounting room, able to issue invoices; one connected to the courier station, able to send letters. When the ledger boy needed to do something, he plugged in the appropriate box and handled it according to the passwords and permissions specified on the box.
The first batch of small boxes was too loose. To check one item, the ledger boy nearly flipped through the entire purchase price book; to send a letter to a customer, he mistakenly used the shopkeeper's private seal. Only then did the shopkeeper realize that giving hands is more dangerous than giving a mouth, and that once external skills run out of control, they bring counter risk into the back courtyard.
He re-established the rules. Each box had to state what it could do, what materials it needed, which ledger pages it could touch, how it would report failure, and who was responsible for maintenance. Sensitive boxes had to be stamped twice, and old boxes were taken down once expired.
The ledger boy was still clever, but he no longer grew hands and feet out of thin air. He could only act through registered small boxes, and whatever he did left a receipt. The firm worked faster, and the shopkeeper also knew where the risks were; if something went wrong, they could trace which box, which passphrase, and which shopkeeper authorized it.
Later, a new assistant asked why not plug in all the boxes. The shopkeeper pointed to the key cabinet and said: the more external capabilities there are, the more they must first become tools that can be found, invoked, constrained, and held accountable. Being able to plug in does not mean it should stay plugged in forever.
Later, before the firm introduced any new small box, it had to be tested in an empty ledger first. What it could look up, whether it would overstep, and how to roll back if it broke all had to be confirmed before it went to the counter. The apprentice clerks therefore handled more and more tasks, but did not become unattended hands. Before every new box went to the counter, it had to answer one question: which hand did it empower, and which hand did it restrain?