13. The Three Questions
Domain: Identity and Access Management — MFA, Access Control Models POV: Thread Reading time: ~15 minutes
The door to the Restricted Archive had changed.
Thread noticed it immediately — because Thread noticed everything, and because Thread had been watching that particular door for longer than anyone else in the city. The silver wire inlay was still there, its patterns still shifting when you looked away and reforming when you looked back. The three words carved above the lintel — Prove yourself. Prove your need. Prove your truth. — were still there, unchanged since the Library’s founding. But something about the door’s behavior was different, and it took Thread three visits to understand what it was.
The door was asking for more.
Before — before Vale’s corruption, before the annotated laws, before the Shroud began pressing at the city’s walls — the door had authenticated visitors with a single test. A name. A palm-print. A whispered word. One factor, sufficient to establish identity, and then the door would open. It was simple, and it was elegant, and it had been, as Thread now understood, dangerously incomplete.
Now the door was asking three questions, and it would not open until all three were answered.
The first question was the one the door had always asked: Who are you? — the question of identity, of authentication, of proving that you were who you claimed to be. The door’s silver wire would form a symbol unique to each petitioner, and the petitioner would respond with the proof that matched: a name, a recognition pattern, the evidence of self that the door had learned to recognize over years of patient observation.
But that was no longer enough. After the first question came the second: What are you permitted to do? — the question of authorization, of access level, of scope. The door’s wire would form a map of the petitioner’s permissions, and if those permissions did not include access to the Restricted Archive — if the petitioner was not properly authorized, properly sponsored, properly documented — the door would not open, no matter how convincingly the first question had been answered.
And after the second question came the third, the one that had never been asked before: What else is true about you right now? — the question of context, of environment, of the circumstances surrounding the request for access. The door’s wire would form a pattern that Thread, after studying it for three days, recognized as a composite of several different signals: the time of day, the petitioner’s recent movements through the Library, the presence or absence of other authorized individuals in the vicinity. The door was not just asking who you were and what you were allowed to do. It was asking whether this particular request, at this particular moment, under these particular circumstances, made sense.
“The door has been reconfigured,” Thread reported to the fellowship, gathered in the shed. “By whom, I do not know — perhaps by the door itself, perhaps by the Library’s foundational enchantments, perhaps by someone with administrator access who has not yet been corrupted. But it is asking three questions now, and it will not open for anyone who cannot answer all three.”
“Multifactor authentication,” Quill said, the technical term rolling off his tongue with the ease of long familiarity, even though the concept itself had never been applied to the Citadel’s doors before. “Something you know — your identity. Something you have — your authorization, your access level. And something you are — your context, your behavior, the circumstances that surround your request. Three different categories of proof, all required simultaneously. If any one of them fails, access is denied.”
“That is what the door to the Restricted Archive should have been doing all along,” Sable said. “If Vale had needed to answer three questions instead of one, he could never have walked in and out as freely as he did. The annotated laws — the margin notes, the corrupted clauses — he could not have written those if the door had demanded to know not only who he was but what he was there to do and whether his presence made sense given everything else the door knew about him.”
Thread nodded slowly. “The door is still learning. The third question — the one about context — is the hardest for it to ask well. It does not yet know what to look for. But it is trying. And while it tries, it will not open for anyone it does not fully trust.”
The fellowship spent the next several days working to spread the door’s new approach across the city — not by replicating the silver wire in every door, which was impossible, but by implementing the principle behind it. Every access point that mattered — the Spire, the Archive, the Library’s restricted sections, the gear-chambers and the maintenance tunnels and the magistrate’s chambers — would require more than one form of proof before it would open.
For the Spire, the solution was the split key and the dual authorization that the council had already approved. But Thread pushed for more — a third factor, a contextual check that would prevent access even when the two keys were present if the circumstances surrounding the request were suspicious. After hours, without prior notice, in the presence of individuals whose authorization was unverified — the door would not open under these conditions, even if both key-holders were present.
For the Archive of Record, the solution was a new logging system that Sable designed and Quill formalized: every access request would be recorded not just in the Archive’s own logs but in a separate, independent ledger kept by a different department. Two records, cross-referenced, could not both be altered by the same person. And the access itself would require not just the usual authorization stamp but a second form of verification — a witness, a counter-signature, a record of the specific documents requested and the specific purpose for which they were needed.
For the maintenance tunnels, Wren’s solution was simpler and, in its way, more radical: the tunnel entrances would remain open during the day, when the tunnels were used by citizens and workers and volunteers, but they would seal automatically at night, when the only people who should be in the tunnels were those with explicit, documented need. The sealing was not about keeping the Shroud out — the tunnels were underground, and the Shroud had not yet found its way into them. It was about ensuring that the tunnels were not used for purposes that their designers had not intended.
“Access control models,” Quill said, as the fellowship reviewed the changes they had implemented. “Different ways of deciding who gets in and why. Role-based access — the tunnel workers have access because their role requires it. Attribute-based access — the Spire’s door checks not just who you are and what key you hold, but when you are requesting entry and who else is present and whether your request fits a pattern of normal behavior. Mandatory access — the highest-security areas, the Founding Laws and the Great Clock, where access is determined by classification level and nothing else.”
“And the door,” Thread said quietly. “The door to the Restricted Archive. It has become its own model — something none of our categories fully describe. It asks three questions, and each question is a different way of knowing whether you are who you say you are and whether you should be where you are asking to go. Identity. Authorization. Context. Three factors, all required. If any one fails, the door does not open.”
Thread paused, and for a moment the only sound in the shed was the distant hum of the gear-trains beneath the floor. “I think the door is teaching us something. Not just about how to secure a single entrance, but about how to think about security itself. One question is not enough. One form of proof is not enough. The world is too complex, and the threats are too subtle, and the people who would abuse the system are too clever. If you want to know who someone really is — if you want to know whether they should be allowed through the door — you have to ask them more than once, and you have to ask them in different ways, and you have to be willing to change the question when the old questions stop working.”
On the last day of the month, Thread returned to the corridor outside the Restricted Archive and stood before the door that had once asked only for a name.
The silver wire shifted as Thread approached. It formed a circle — the same circle it had formed the first time, the circle with the question mark at its center. And then, without waiting for Thread to speak, it formed a second shape: a branching tree, the map of permissions, the authorization that Thread had never formally received but that the door, in its new wisdom, seemed to recognize anyway. And then a third shape: a pattern that Thread understood, after a moment of study, as a representation of context — the time of day, the recent movements through the Library that the door had observed, the absence of any suspicious circumstances.
“Identity,” the door said, and its voice was the rustle of pages and the settling of dust and the quiet, ancient patience of a mechanism that had been asking questions for centuries. “Authorization. Context. Three questions. Three answers. One truth.”
The door swung open.
Thread stepped inside, and the Restricted Archive was exactly as Thread remembered it — the circular room, the curved shelves, the reading table at the center. The annotated law-book was still there, still open to the page where Vale had written his margin notes, still bearing the evidence of his corruption. But beside it, on the table, was a new book — a smaller volume, its binding fresh, its pages blank.
Thread opened it. On the first page, in handwriting that Thread did not recognize, were three words:
Ask better questions.
And beneath that:
— The Door
Thread smiled — a small expression, almost imperceptible, the kind of smile that only the door would have been able to see. Then Thread sat down at the reading table, opened the new book to its first blank page, and began to write.