Fable
The fake assassin drill before the royal banquet
The royal city held a grand banquet every year. Guards checked people against the guest list, guests presented seals, and cooks delivered dishes by door plate. After many peaceful years, everyone felt this protocol was already strict enough.
After the new king ascended the throne, the banquets doubled in scale, with envoys, merchants, theater troupes and temp workers arriving. The master of ceremonies made the door signs larger and stationed guards more densely, thinking that as long as they were more diligent they could hold the line.
An old general proposed that before the banquet, several trusted people should be asked to pose as troublemakers. The master of ceremonies was very displeased, feeling this was like distrusting the dignity of the royal city.
On the first night of the drill, the fake envoy did not climb over the wall—he simply held an old invitation with vague wording and asked the guard to "make an exception in accordance with the king's true intent." The guard hesitated and then let him through, because he had never been trained to refuse a seemingly reasonable request.
On the second night, the fake cook slipped the allergy list onto the back of the menu and induced the errand boy to change three tables' dishes. No one broke a lock; the problem was that the process assumed every piece of paper was trustworthy by default.
The master of ceremonies first wanted to stamp all papers with three seals. As a result, the line jammed at the door, and even genuinely urgent changes could not be processed.
The old general divided the drill records into several categories: identity induction, rule bypass, information contamination, privilege escalation, and denial of service. Each category was paired with a reviewable line of defense, rather than just shouting “be more careful.”
There was no story on the day of the great banquet. The guards stopped several fine-sounding excuses, and the kitchen workers found two suspicious menus. Only later did the king understand that true security came from someone seriously playing the attacker in advance. Later, an even more difficult task arrived. On the surface it looked like just an amplified version of the old problem, but in fact it forced out all the gaps hidden in the process: who takes over first, who can make changes, and how to return to the previous step when something goes wrong. Places that used to get by on familiarity and tacit understanding now all had to be made clear. The person in charge did not urge everyone to be more careful again; instead, he walked through the site once more. He had people record every handoff, every failure, and every recovery—which places were merely slow, which places would harm the result, and which places, once wrong, would be hard to trace back. After the new rules were rolled out, the first few days were not smooth. Some complained about an extra check, and some felt their old experience had been offended. But when the next anomaly appeared, for the first time everyone could follow the traces to find where the problem had occurred, instead of gathering around the result and guessing at each other.