Fable
No longer a secret code written in the corner
The old post station had many secret codes: passwords for opening the silver vault, tokens for contacting the outer city, and marks for letting fast horses through. The clerks, afraid of forgetting, often wrote the codes in the hidden layers of the account books.
After the station connected the messaging puppet, the puppet needed to call map, mail, and warehouse interfaces. For convenience, the craftsman stuffed all tokens into the same configuration page.
One day, the puppet carried the contents of the configuration page into an error report. The report was sent to an outsourced repair shop, and several tokens left the city with it. No one stole the door; the door handed out its own keys.
The stationmaster first ordered everyone not to write secret codes in reports. But the codes were already scattered across scripts, environment variables, chat logs, and old backups, and no one knew which ones were still valid.
The new stationmaster built a code library. Tokens were no longer handed directly to the puppets; instead, the storehouse issued short-term credentials temporarily by task. Who retrieved them, to whom they were given, when they expired and whether they were rotated were all recorded.
High-risk secret codes require two-person approval, old tokens are rotated regularly, and they can be revoked immediately after a leak. The puppet can only obtain credentials for a certain scope of a certain tool, and cannot see all the original text.
Later there was another erroneous report sent out. It contained only a credential number and a failure reason, with no usable secret code. The duty officer rotated the relevant tokens by number, and business did not stop.
The courier station finally reclaimed its secret codes from people's memories and scattered files, turning them into assets with lifecycles, permissions, and audits. The stationmaster said that an assistant capable of acting in the outside world holds not strings, but the keys to the enterprise. Keys must be managed, not copied. Later, an even trickier job arrived. On the surface it looked like an old problem magnified, but in fact it forced out every gap hidden in the process: who takes over first, who can make changes, and how to return to the previous step when something goes wrong—places that used to be glossed over by familiarity and tacit understanding now all had to be made clear. The person in charge did not urge everyone to be more careful; instead, he walked the site again. He had people record every handoff, every failure, and every recovery, noting which spots were merely slow, which could harm the results, and which, once wrong, would be hard to trace back.