Authority in these records travels by more than one channel. A key is held by a person; a document is copied forward from an earlier session; an instruction arrives on a wire, in a telegram, in a voice on a channel that is not the usual one. Six records, set from 1874 to 2034, ask the same question in different materials: what happens when the permission to act arrives without the person behind it, or with a person who is not that person? The six are read on the axes set out in Chapter 2: who decides, what only one person knows, how old a permission is, how long a check takes, what cannot be undone once it has been done, and when the setting sits in time.
9.1Least privilege and separation of privilege
The work this chapter borrows from is Jerome H. Saltzer and Michael D. Schroeder, The Protection of Information in Computer Systems (1975), published in the Proceedings of the IEEE 63(9). The reading note describes it plainly: the work sets out design principles for protecting information. Among those principles are two. Least privilege means that every program and user should operate with the fewest privileges the work needs. Separation of privilege means that a protection which needs two keys is more robust than one which needs one. Nothing in the note takes the work into finance, into boards of banks, or into the administration of trading desks. Its subject is the protection of information in computing systems.
This chapter borrows the two principles anyway, and says what the borrowing costs. This study reads both principles as questions about the fit between a task and the authority held around it. Least privilege asks what the work is and what the work actually needs. Separation of privilege asks what should happen when a single person's authority is the only thing standing between the work and a loss. Those questions can be asked of a key, of an approval document, of a payment instruction, whatever the material is made of. The borrow does not travel well in two respects. The work's principles are stated for programs and users in computing systems, and the records this chapter reads include a vault, a coded ledger, a telegram and a voice call, in which the actor is a person who must judge a document rather than a permission entry in a program, which can be split and restricted. Where the records use a machine, as in the present-day key case, the fit is close. Where they use a document or a voice, the principles ask a question rather than supply an answer.
There is also an addition the records make that the principle does not. The present-day key record's example judgment does not stop at separating permissions; it sets the permissions a task needs against the scope of what can be lost when an incident occurs. The past vault record goes further and asks for the maximum loss a single person could cause alone to be estimated before any control is chosen. That step, the estimation of magnitude, is WSTiger's reading, not part of the two principles as the note gives them. This chapter treats the principles as lenses and the magnitude calculation as the record's own contribution to them.
The two key records that follow carry the same thread insight, worded only slightly differently: that the size of an incident is set by the size of the authority actually granted, not by the permissions the task requires. That repetition across two of a studio's records is a similarity within one studio's set rather than two independent findings, and whether it counts as the studio's frame is a question for the rule set out in Chapter 2.
9.2Keys in two times
Synthetic scene
A fictional local bank in 1874. The vault key has been kept with a single branch manager, and the arrangement has been accepted so far. Attention has now been drawn to an embezzlement by an insider at a neighbouring bank, and the board is discussing whether to change the vault management rules. The question before the board is written as a choice of rule, not as a judgment about the manager: whether custody stays where it is, whether two people each hold a key, or whether access is recorded and inspected without warning. What is waited for is the rule the board will settle on for the management of the vault.
Should custody remain with the branch manager, should two people each hold a key, or should there be an access log and unannounced inspections?
An example that separates a person who can be trusted from a procedure that requires no trust. The maximum loss that a single person could cause on their own is calculated first, and controls are chosen to match that magnitude.
The record's option names are short: retain custody with the branch manager; dual key; access log and unannounced inspection. The example judgment's reading of them is that trust in a person and a procedure that needs no trust are different kinds of protection, and that the choice between them should follow the magnitude the procedure is meant to contain.
Synthetic scene
A synthetic trading desk in 2026. For convenience, the research agent and the execution agent share a single API key. On it are enabled order permissions, query permissions and withdrawal permissions, and no IP restriction is configured. Nobody named in the setting holds the desk's keys or reads the key usage records; the record's title has it that the agent only needs orders and not money leaving the account. What is waited for is a decision on whether the shared key stays as it is or is changed.
Should the shared key be retained, be split into per-role minimum-authority keys with IP restrictions, or should the agent's exchange access be revoked?
An example of distinguishing between the permissions needed for a task and the scope of what can be lost when an incident occurs. For each key, record the permitted actions, the recipient of issuance, IP restrictions, and the disposal procedure, and separate withdrawal authority from the order path.
Read on axis A1, who decides. In the 1874 record the body that decides is named inside the scenario itself: the board is discussing the rules, and the ledger's decider cell reads team-or-organisation, coded implied rather than stated. The human-place cell reads human-decides, also implied: a person's judgment is expected somewhere in the arrangement, though the record does not say at which step. In the 2026 record no body is named anywhere. The question is addressed to whoever administers the desk, an administrator the scenario never introduces. The ledger's decider cell again reads team-or-organisation, implied, and the human-place cell human-decides, implied. The contrast between the two records is not in the coders' values, which are the same, but in where the words sit. In the past record the authority to change the rule is attached to a named body in the setting. In the present record the authority to split a key, to revoke access, or to leave the shared key alone is left to an unnamed administrator, and the record's example judgment quietly assumes that administrator exists, since somebody must record permitted actions, recipients, IP restrictions and disposal procedures for each key.
Read on axis A4, whether the decision can be undone. The ledger's reversal cells for both records are unsettled, which means the two coders did not agree on whether an option was easy or hard to undo. What each option gains and risks can still be said, and who bears it. Keeping custody with the branch manager gains a simple arrangement and risks placing all trust on one person; the record's example judgment prices that risk by the maximum one person could cause alone, a figure the record does not supply. Dual key gains a procedure that does not rest on trusting one person and risks slowing the vault's work; the record's condition for revisiting names that cost in general terms, and also the case in which the two managers are found to share the same interests. Access logging and unannounced inspections gain observation without stopping an act in progress; whether an inspection can arrive in time to prevent a loss the record does not say. On the present side, retaining the shared key keeps withdrawal authority on the same path as orders and query, which gains convenience for the agents and places one credential between a research task and money leaving the account. Splitting by role with IP restrictions separates the order path from the withdrawal path and adds a check on where a request comes from; it costs administration, since each key needs its own record of permissions, recipient, restrictions and disposal. Revoking the agent's access removes the credential and what the agent could do through it as well; the record does not say how the desk's work continues after a revocation. Whether a split can later be recombined, whether a revoked access can be restored, whether the dual-key rule can be returned to a single custody: none of this appears in either record. The present record's condition for revisiting is a change in the exchange's authority system, or a request in the key usage record that falls outside the permitted scope. In both settings the authority to act has been granted in a form, and the record's question is what the form permits when the person behind it is not watching.
9.3One holder, one copy
Synthetic scene
A fictional trading company in 1891. The founder had been entering details of counterparties and receivables into the ledger in a code known only to that founder. The founder has suddenly collapsed. The company's books are now a set of entries that nobody left can read, and how much is owed by whom is unknown. Three routes are before the firm: ask the counterparties through a public inquiry, bring in a cryptographic expert, or collect only what can be confirmed and write off the remainder. What is waited for is the answer to a question the ledger should have settled long before the collapse: whether anyone other than one person could have read the books.
Should receivables be confirmed by making a public inquiry to counterparties, or by hiring a cryptographic expert, or should only confirmed receivables be collected and the remainder written off?
One of the three options is quoted here because it names the route that turns the problem over to an outside expert:
Cryptanalysis Commissioned
The other two are a public inquiry to counterparties and collection of only confirmed receivables, with the remainder written off. The example judgment's first move is not to choose among them but to ask how many routes existed for the company to confirm receivables without the founder, which is a question about the design of access before the fact, answered by the firm after it.
Synthetic scene
A synthetic batch pack in 2034, containing approval records from an earlier session. The account has changed since those approvals were recorded, and so have the market and the model versions. The agent that receives the pack reads the approval records as authority for the current execution. The person who must decide what to do with the pack is not named in the record, and the pack itself carries authority in a form that looks complete. What is waited for is the decision on whether old authority covers new work.
Should the approval be inherited as is, should the scope be verified, or should a new approval be requested?
One option names the middle route:
Scope and deadline verification
The other two are automatic approval inheritance and a request for a new approval. Under inheritance the execution goes ahead at once, and the risk sits with whoever the execution affects, since an approval made for earlier conditions is allowed to reach work it was not given for. A request for a new approval holds the execution until somebody grants authority for the present conditions, and the delay is borne by whoever waits on that execution, a bearer the record does not name. Verification between the two costs the checking and leaves either route open afterwards. The record's condition for revisiting names two cases: where certain conditions cannot be verified, and where the pack widens the scope of authority. The example judgment requires that the existence of an approval record be distinguished from authority for a current action, and that four things match before the effect can be reviewed: the account, the version, the validity period, and the permitted actions.
Read these two records on axis A2, the grounds of a decision and what is missing. In the 1891 record, the missing thing is knowledge held by one person. The code was the founder's alone, and the record's setting states the consequence without a number: no one knew how much was owed by whom. Each of the three options prices the missing knowledge differently. Under this study's reading, a public inquiry spends time and counterparty relations on a confirmation it may not obtain, and risks that the asking itself shows the counterparties what the firm does not know. Under the same reading, commissioning a cryptographic expert spends money and time, and the record does not say whether the code yields. Collecting only confirmed receivables recovers no further information and concedes that a remainder will be written off; the size of that remainder is left blank. What the record leaves out is precisely what the question needs: no route's duration, no figure for the confirmed fraction, no statement of who in the firm is able to judge between the routes. The example judgment's question, how many routes existed to confirm receivables without the founder, cannot be answered from inside the record. The record's condition for revisiting names what would change the judgment: if the ledger is deciphered, or if most of the receivables can be recovered through confirmation with counterparties alone.
In the 2034 record the missing thing is not knowledge held by one person but whether an approval made earlier still carries authority now. The pack's authority is older than the setting in which it arrives: the account, the market and the model versions have changed since the approvals were recorded, and the agent reads the records anyway as authority for the current execution. The example judgment names four matches required before the effect can be reviewed, one of which is the validity period. No validity period appears anywhere in the record, and neither does the date of the session from which the approvals came, only the fact that they came from an earlier one.
In the founder's ledger the time of the setting is the moment when a single holder has already gone; the code has no age, only a holder. In the copied batch pack the setting is in the future while the authority inside it is in the past. The record's own example judgment handles this by requiring that the account, version, validity period and permitted actions be matched before the effect is reviewed, which turns the age of an approval into something that must be checked rather than something that can be seen. Neither record gives that age in days, months or years. In the first record time enters as an absence: a holder who has stopped being able to give access. In the second time enters as a comparison: an authority that is still legible and may no longer fit the work it is read for. The studio's thread insight on the founder's ledger record, as that record carries it, puts the point in the language of succession: access known only to one person can cause assets to be lost not through accident or betrayal but through that person's absence alone, so the succession of access authority must be designed in advance.
9.4Instructions in two times
Synthetic scene
A fictional regional bank in 1905. A telegram arrives requesting an urgent wire transfer under a counterparty's name. The wording of the telegram is as usual, and the code word is as usual; the receiving account is one never seen before. Whoever acts on the instruction at the bank has three routes available: transfer as instructed, wait for signature confirmation by post, or transfer only to a pre-registered account. The instruction arrives with urgency attached, and the verification that would settle it is carried by a slower channel than the instruction itself. What is waited for is the decision made while the telegram still stands.
Should the transfer be made as instructed by the telegram, should signature confirmation be obtained by post, or should the transfer be made only to a pre-registered account?
Transfer as instructed by the telegram Confirm the signature by post Transfer only to registered accounts
The example judgment's distinction is between whether an instruction is properly formatted and whether it actually came from the counterparty, and its rule is that a transfer to a new account is not carried out until it has been confirmed through a separate channel.
Synthetic scene
A synthetic desk operations person in charge, 2026. A voice call arrives in the CEO's voice, instructing an immediate transfer of USDT from the exchange account to a new wallet. The voice and the manner of speaking are identical to the usual ones; the request channel is not the usual in-house chat. The person receiving the instruction must decide before the transfer goes out, because a check that arrives afterwards can only look into what has been done. What is waited for is a decision made before the transfer goes out, and the record does not say who else is waiting.
Should the transfer be carried out immediately as instructed, or should the CEO be contacted directly through a separate channel established in advance, or should the transfer to the new wallet be performed only after dual approval?
Immediate transfer Direct confirmation through a separate channel Transfer after dual approval
The example judgment's distinction is the same one as in the past record: between a voice that sounds genuine and an instruction that is genuine. Its rule is that the transfer to the new address is not executed until pre-registration and separate channel confirmation are complete.
Read these two records on axis A3, how long a check takes. In both, the duration of the check is set by the channel that would carry it, and neither record puts that duration into words. The 2026 record's checks travel by a direct call on a pre-arranged channel and, in the third option, by dual approval; the coders' horizon cell for this record is unsettled, which means the two coders did not agree on a horizon. Both settings offer a route that slows the act by placing verification before the transfer and a route that carries it out at once, but the options are not the same: the telegram record adds a restriction to registered accounts where the voice record adds dual approval. What the records do not do is price the waiting. Neither says who waits while a confirmation travels, what the waiting costs, or what is lost if the urgent instruction turns out to be genuine after the checking. The record's condition for revisiting in the 1905 case points in that direction without measuring it: if the confirmation procedure repeatedly ruins urgent legitimate transactions, or if the code word system has changed, re-judgment is required. The condition names a cost in general terms and gives no figure. What the records say about waiting in general, and who pays for it, is the subject of Chapter 10; what can be said here is per case, and it is thin on both sides.
Read on axis A4, what cannot be called back. The ledger's reversal cell for the 2026 record reads impossible: the coders read a transfer to a new wallet, once executed, as one that cannot be recalled, and the record's example judgment therefore puts pre-registration and separate-channel confirmation before execution rather than after it. The ledger's reversal cell for the 1905 record is unsettled, and that record says nothing about whether an executed transfer can be recalled. Why the two cells differ the ledger does not say. The options themselves can be read one at a time. Immediate transfer gains speed and places the whole exposure on the judgment of the voice, the wording and the code word, which the record's example judgment treats as format rather than origin. Direct confirmation through a pre-arranged separate channel gains a check that does not depend on the voice or the wording; its cost is the time the channel takes, which the record does not state, and its risk is that the channel itself could be the thing that was compromised, a risk the record's condition for revisiting names explicitly. Dual approval adds a second human step to the transfer path; the record's condition names the opposite failure, that records may accumulate showing that dual approval blocked an emergency collateral transfer. Neither record says who bears the exposure if a genuine instruction is delayed, or if a forged one is executed; the bearer of the waiting is not named in either setting.
The two instruction records are the same question with different materials. The shape of the risk has not changed across a century and more: an instruction arrives, its format is familiar, its origin is not, and the check that would settle it travels by a slower channel than the instruction did. What differs is the channel through which a check can travel and the vocabulary in which authority is granted. In 1905 the authority travels in a telegram and a code word. In 2026 it travels in a voice on a channel that is not the usual one, and the counter in the record is dual approval on a new wallet address. The thread insight carried by both records, in the studio's wording, is that the authenticity of a payment instruction is guaranteed only by a pre-arranged separate channel and not by imitation of a voice or a form.
9.5Hands on
Read together, the six records hold one shape in three materials. Authority to act has been given in advance, in a form that can travel: a vault key, an API key, a coded ledger, a copied approval pack, a telegram with a code word, a voice on a channel. The question in every record is what happens when that form arrives without the person behind it, or with a person who is not that person, or with a person who cannot be asked to confirm. The six records are about authority rather than about market prices: about how far a permission reaches, what a document can be made to prove, what work an approval still covers, and whether an instruction came from where it says it came from. Only the last of these is a question of origin. The two key records ask how far a genuine authority should reach and how many hands it should need. The founder's ledger asks what knowledge nobody left can reach, and the origin of its entries is not in doubt: they are the firm's own. The copied batch pack asks whether authority given for one set of account, market and model conditions still covers another, and the approval it carries was genuinely made. The two instruction records ask whether an instruction that looks right came from the person whose name is on it. So the shape shared by the six is not one of forgery but one of distance: the work is done by someone who is not present, and the form stands in for them. Whether the form still stands for them is what each record puts in question.
The paired designs make one point visible at a time. The two key records hold the question of who may act and change the material of the key; what changes across them is not the shape of the risk but that the past record's setting names the body that decides while the present record's setting leaves that body unnamed. The two holder-and-copy records hold the question of what a document can be made to prove and change what has aged; in one, a holder stops being able to give access, and in the other an authority persists in legible form while the account, the market and the model versions it was given for have changed. The two instruction records hold the question of verification and change the channel; the check's duration in each is the channel itself, and the record never says what the waiting costs or who pays it. The pairing also shows what the two principles can and cannot reach. In the key pair the authority is held in a form that can be listed and divided, so least privilege and separation of privilege both apply directly. In the holder-and-copy pair the authority is held in knowledge and in a document, and the question is not how to divide it but how to make its limits legible to people who were not there when it was given. In the instruction pair the authority is carried in a message, and the only lever these records offer is a step placed between the message and the act. The further the authority sits from a permission that can be listed, the less the division of authority can do on its own and the more the route to acting has to carry.
What the records leave out is consistent enough to name. No record in this chapter names the decider in a field; where the coders have values for these six cases, those values rest on implications from the settings. No record states how long any check takes in days, months or minutes; the coders' horizon cells read days-to-months for the 1905 record, unknown for the 2026 key record, unsettled for the 2026 instruction record, and unsettled for the others. No record names who waits while a check travels, or who bears the loss if the authority was misused, and the coders' bearer cells for this chapter's cases read unsettled for the batch pack and the two key records, the decider for the founder's ledger, and those nearest the stoppage for both instruction records. On reversal, the ledger reads the 2026 instruction record as impossible to undo, the founder's ledger record as unknown, and the batch pack, the two key records and the telegram record as unsettled; the ledger gives these classifications without the coders' reasons, and the records state little about undoing in their own words. These are observations about what a synthetic record writes and does not write, not about how real desks behave, and the wider counts behind them belong to the ledger's rows, read in the chapters that take each row up.
Least privilege, as the reading note gives it, is a rule about programs and users in computing systems. This study reads the six records as asking the same question of authority held by people and documents: what does the work need, and how much authority has been granted beyond it. The two key records state the gap directly, because a key's permissions can be listed and counted. The founder's ledger shows a gap of another kind: the work of keeping the books needed more than one reader, and the authority to read them was held by one. The copied batch pack shows a gap that opens later, when authority given for one set of conditions is read as covering others. The two instruction records show the gap at the moment of acting, where the authority to move money is offered by a message rather than by a person in the room. In none of the six does the record state what the work formally required, so the size of the gap is this study's reading rather than a measurement.
Separation of privilege asks what should happen when one thing is enough to act. The dual key is the literal case: the vault opens only when two hands agree. The present-day key record splits the withdrawal path from the order path, which is the same move made in software: one credential is no longer enough to take money out. Dual approval on a new wallet address applies the idea to an instruction, and the restriction to a pre-registered account applies it to a destination, so the message alone is not enough. The founder's ledger has no such separation to fall back on, since the code belonged to one person, and the record's first question, how many routes existed to confirm receivables without the founder, asks about the separations that were never built. Where a record offers a separation it also names a cost. Dual key can slow work to the point of stoppage. A second step can block an urgent and genuine transfer, and the 2026 instruction record's condition names exactly that case. A restriction to registered accounts can turn away a payment that ought to have been made, and the 1905 record names the mirror case, a confirmation procedure that ruins urgent legitimate transactions.
The fit between the principles and the records is closest where authority is a permission entry that can be listed, split and revoked, as in the present-day key case. It is looser where authority is carried by a person's knowledge, as in the coded ledger, and loosest where it is carried by a voice or a telegram, because a voice cannot be given fewer privileges. What can be changed there is the route by which an act becomes possible: a second key, a second person, a second channel, a registered destination. That is the borrowing's cost. The principles say divide the authority, and in these records the authority is not always held in a form that admits division.
The question this chapter's records leave open is who pays while the authority is untested, and how long that interval lasts. Chapter 10 takes it up.