Fable
Once there are many keys, opening the wrong door is more dangerous than having no key at all
The service hall of Sea Salt City had a row of keys. The red key opened the archive cabinet, the bronze key opened the accounting room door, the black key opened the warehouse, and the silver key could issue announcements. In the past there were few keys, and an old clerk could tell at a glance which one to take for a request.
Later the hall connected to more places. You could check tax ledgers, send letters, change inventory, book carriages, issue invoices, freeze accounts. Every key was useful, and every key could cause trouble. What newcomers feared most was not having no keys, but not knowing whether they should use a given key.
The steward first posted a big notice: use the red key for archive issues and the bronze key for accounting issues. The notice quickly became useless. A merchant supplementing an invoice involved both accounting and archives; a warehouse return required changing inventory and might also trigger a refund. Real tasks never line up according to the boxes on the notice.
Someone suggested giving all the keys to the cleverest clerk and letting him choose by feel. For the first few days it was fast, until he opened the complete accounting ledger just to look up a customer address; and to confirm inventory, he modified an order that had not yet been approved. The work got done, but the risk came in with it.
The worst time was when the silver key was used to post a public notice. The clerk meant to send a draft to one merchant, but posted an unreviewed price list at the city gate. It wasn't that he wasn't smart—it was that he wasn't required to first assess action risk, parameter boundaries, and whether approval was needed.
Later the hall changed key selection into three steps. First look at task intent: is it to query, to modify, to notify, or to create a new record. Then look at tool capabilities and limits: which key can do this thing, which can only read and not write. Finally look at risk: whether it involves money, identity, external notification, or irreversible operations.
Each time the clerk takes a key, he must write the reason for the choice and the key parameters on a small tag. Low-risk queries can be done directly; changing accounts, issuing announcements, and deleting records must be stamped by the manager; if either key can do the job, choose the one with narrower permissions and more reversible results.
The hall did not slow down because of this extra set of choices. On the contrary, rework and incidents decreased. Everyone understood that the real skill is not having the most keys, but choosing the one that is strong enough for each subtask without over-authorizing it.