12. The Two Keys
Domain: Identity and Access Management — Least Privilege, Separation of Duties POV: Kip Reading time: ~15 minutes
The Spire of Measures had only one entrance, and it took only one key to open it.
Kip had never thought about this before — not during the crisis of the repeater device, not during the hours spent documenting the false pulses, not during any of the long days that followed. The Spire’s entrance was guarded by two automaton sentries, and entry required the authorization of a magistrate. That had seemed like enough. That had seemed like more than enough.
But Thread had been watching the Spire, because Thread watched everything, and what Thread had noticed was simple and devastating: the Keeper of the Clock, Orin, had been entering the Spire alone. Every day. At hours when no one else was present. Using a key that he possessed and no one else needed to verify.
“One person,” Thread said, spreading a log of Orin’s movements across the workbench in the shed. “One key. No witness. No counter-signature. No requirement that anyone else be present to verify what he does inside. He walks in, he does whatever he does, he walks out. And no one knows what happens in between.”
The implication hung in the air of the shed like smoke. One person with one key had installed the repeater device in the Great Clock. One person with one key had been corrupting the master beat for weeks before anyone noticed. One person with one key — compromised, perhaps, or coerced, or simply ambitious — had nearly destroyed the city’s foundation of truth.
“We need to change how the Spire is accessed,” Sable said, and her voice was hard. “Before something worse happens.”
The proposal that emerged from three days of debate — conducted in the shed, in Penric’s chambers, in the Library’s public gallery and its restricted stacks — was radical enough that even Quill, who had grown accustomed to radical proposals over the past weeks, needed a full day to accept it.
No single person would hold the key to the Spire. The key itself would be split — not literally, but functionally — into two parts. One part would remain with the Keeper of the Clock, whose role required access to the Spire’s mechanisms. The other part would be held by a magistrate — not Vale, whose loyalty was now beyond question in the worst possible direction, but Penric, whose integrity had been tested and verified. Neither could enter the Spire without the other. Neither could act alone.
“Separation of duties,” Quill said, reading from one of the old treatises on civic administration that he had unearthed from the Library’s stacks. “It is one of the oldest principles of governance. Critical actions — actions that could cause great harm if performed incorrectly or maliciously — should require more than one person. Not because any individual is untrustworthy, but because requiring two people to act together makes it much harder for either one to act corruptly in secret.”
“And the key itself,” Sable added, “must be limited. The principle of least privilege: every person should have only the access they need to perform their function, and nothing more. The Keeper of the Clock needs access to the Spire to maintain the mechanisms — but does he need access at all hours, without supervision, without anyone else knowing he is there? No. That is privilege beyond what his function requires.”
Kip listened to the debate and asked the questions that no one else was asking. “What about the other magistrates? What about the engineers who maintain the gear-trains? What about the archivists who need to consult the records stored in the Spire’s lower chambers? They all need some access — but how much? And how do we make sure they have exactly what they need and nothing more?”
The answer, when it came, was not a single solution but a framework — a set of principles that could be applied not just to the Spire but to every access point in the city that mattered.
Quill drafted it, because Quill drafted everything, and the document that emerged from his ink-stained fingers was the most comprehensive thing he had ever written. It established, for the first time in the Citadel’s history, a formal system of access levels — not the informal, customary permissions that had governed the city for centuries, but explicit, documented, verifiable tiers of authorization.
Level One: public access. The galleries, the markets, the open shelves of the Library. Available to every citizen and every visitor without restriction.
Level Two: operational access. The maintenance tunnels, the gear-chambers, the infrastructure spaces that kept the city running. Available to engineers and maintenance workers, granted by their guild supervisors, reviewed quarterly.
Level Three: restricted access. The Spire’s lower chambers, the Archive of Record, the Library’s Upper Stacks. Available only to those who could demonstrate a specific, documented need — and even then, only in the presence of a second authorized person, and only with a record kept of every entry and every action.
Level Four: critical access. The Great Clock itself. The Founding Laws. The mechanisms that governed the city’s most fundamental functions. Available to no single person under any circumstances. Every action at this level required two authorized individuals, acting together, with independent records kept by each.
“The principle is simple,” Quill explained to the assembled council. “No one gets more access than they need. And no one whose access could cause catastrophic harm gets to exercise that access alone. If the Keeper of the Clock had been operating under these rules, the repeater device could never have been installed — because Orin could not have entered the Spire without Penric, and Penric would have seen what he was doing, and the record would have shown exactly who was present and when.”
The implementation was harder than the design, as implementation always was.
Wren, who had become the fellowship’s unofficial liaison to the city’s infrastructure workers, spent two days arguing with the guild of engineers about why their access to the gear-chambers needed to be logged and reviewed. “We have been maintaining these tunnels for two hundred years,” the guild-master protested, “and no one has ever questioned our right to be there.”
“No one is questioning your right,” Wren said, with the particular patience she had learned from weeks of navigating bureaucratic resistance. “We are questioning whether a single engineer, acting alone and without oversight, should be able to access a gear-chamber whose failure could cripple an entire district. The answer is no. Not because we distrust you — because we distrust the Shroud, and Vale, and anyone else who might try to use your access for purposes you never intended.”
Thread, meanwhile, took on the task of mapping every access point in the Inner Ward — not just the doors and the gates and the ventilation shafts that had been the focus of the defense against the Shroud, but the smaller, subtler points: the document request forms that archivists used to retrieve materials from the restricted stacks, the authorization stamps that magistrates used to approve access elevation requests, the logbooks — like the one Sable had discovered in the Archive of Record — where entries could be scraped away and rewritten. Every point where a single trusted person could act without oversight was a vulnerability, and every vulnerability needed to be closed.
The work was tedious and unglamorous and absolutely necessary, and it taught Kip something that he had not expected to learn: that security was not only about walls and barriers and defenses against external threats. It was also about the quiet, invisible work of designing systems so that no single person — no matter how trusted, no matter how senior, no matter how long they had served — could bring the whole thing down.
One week after the new access system was implemented, Thread caught someone trying to circumvent it.
It was a junior archivist — not Vale, not Orin, not one of the magistrates whose loyalty had been questioned. A young woman named Lissa, the same Lissa who had helped direct citizens through the maintenance tunnels during the gate failures, the same Lissa who had been one of the first to volunteer for the evacuation efforts. She had been attempting to access the Archive of Record after hours, alone, using a key she had obtained from — she refused to say from whom.
Thread brought her to the shed, and Kip was the one who questioned her. Not because he was the best at questioning — Sable was better, and Thread was better, and even Quill, with his methodical citation of applicable regulations, could have extracted more information. But because Kip was the one who asked the questions that got at the reason behind the action, and that, it turned out, was what mattered.
“Who gave you the key?” Kip asked.
Lissa’s face was pale and set. “I cannot tell you.”
“Did Vale give you the key?”
She flinched, and the flinch was all the confirmation Kip needed.
“What did he ask you to do with it?”
Lissa was silent for a long moment, and then the composure she had been maintaining cracked, just slightly, and the words came out in a rush. “He said it was for my protection. That I needed access to the records to verify something — something about my family, about a birth certificate that had been altered. He said it was a small thing, a favor he was doing for me, and that I should not tell anyone because the records were sensitive and the other magistrates might misunderstand.”
Kip looked at her — at the fear and the confusion and the genuine, bewildered hurt in her face — and he understood something he had not understood before. Vale was not only corrupting the systems from above, through his position as Chief Archivist. He was also recruiting from below — finding vulnerable people with legitimate needs, offering them small, seemingly harmless favors, and using those favors to build a network of compromised access that reached into every corner of the city.
“You do not need the key,” Kip said quietly. “Whatever Vale told you — whatever he promised — it is not true. The records are not altered. Your family is not in danger. He was using you, the way he used Orin, the way he used every other person he recruited. And if you had gone into the Archive alone tonight, with that key, he would have owned you — because whatever you did in there, whatever he asked you to do next, you would have been too compromised to refuse.”
Lissa’s face crumpled, and she began to cry — not the dramatic sobbing of someone caught in a lie, but the quiet, exhausted tears of someone who had been carrying a burden she did not fully understand and was only now beginning to realize how heavy it had been.
“Least privilege,” Quill murmured, standing at the back of the shed. “Lissa had access she did not need to a place she had no legitimate reason to enter. And the person who gave her that access — Vale — was operating alone, without oversight, because the old system allowed him to. The new system would have caught this before it happened. Two people would have been required to authorize her access. Her need would have been verified. The key would have been logged.”
“It worked,” Kip said. “The system caught it. Thread caught it. And Lissa —” He looked at the young archivist, who was wiping her eyes with the sleeve of her robe. “Lissa is not a criminal. She is a person who was manipulated by someone she trusted. The system protected her as much as it protected the Archive.”
Thread, who had been silent throughout the questioning, spoke for the first time. “That is what good access control does. It protects the system from the people who would abuse it. But it also protects the people from being placed in positions where they could be compromised. Lissa should never have been given that key. The fault is not hers. The fault is in a system that allowed a single person — Vale — to grant access that should have required multiple approvals.”
Kip looked at the new access framework, pinned to the wall of the shed — Quill’s careful handwriting, Sable’s annotations, Thread’s observations, Wren’s practical modifications. It was not perfect. No system was perfect. But it was better than what had come before — better than the informal customs and unexamined assumptions that had governed the Citadel for centuries. It acknowledged what the old system had refused to acknowledge: that trust was not a substitute for verification, and that no single person, no matter how trusted, should ever hold the keys to the kingdom alone.