14. The Bridge of Questions
Domain: Zero Trust POV: Wren Reading time: ~15 minutes
The bridge had stood for three hundred years without a single guard, and that, Wren was beginning to understand, was exactly the problem.
It was called the Span of Accord — a graceful arch of brass and stone that connected the Citadel to the Library across the narrow channel of the Silver River. For centuries, anyone who wished to cross had simply walked across. Merchant caravans rattled over its stones without pausing. Scholars came and went between the two great institutions without anyone asking who they were or why they were traveling. The bridge was a symbol of openness — of the principle, enshrined in the Founding Laws, that knowledge should flow freely between the city and its Library.
But the Shroud had changed everything. If the Shroud could corrupt the Wall by pressing against a cold patch of brass, if it could seep through a forgotten service door and pool in an abandoned corridor, then it could certainly cross an unguarded bridge. And if the Shroud reached the Library — the infinite halls, the living books, the ancient knowledge that had been accumulating since before the city was founded — the damage would be catastrophic in ways that Wren could barely imagine.
“We need to guard the bridge,” Wren said to the emergency council. “Not just with soldiers, not just with a door. We need to verify everyone who crosses. Every single person, every single time, no exceptions.”
“Every time?” one of the magistrates asked — a man named Corvin, whose skepticism was legendary and whose willingness to question proposals had made him both valuable and exhausting. “The bridge has been open for three centuries. You are proposing that we treat every person who crosses — respected scholars, senior archivists, magistrates who have served the city for decades — as though they were potential threats?”
“Yes,” Wren said. “That is exactly what I am proposing.”
The principle, Wren explained, was one that Sable had articulated weeks ago and that the entire fellowship had come to embrace: trust was not a substitute for verification. The fact that someone had crossed the bridge safely a hundred times before did not mean they would cross it safely the hundred-and-first time. The fact that someone held an important title or had served the city for many years did not mean they could not be compromised — by Vale, by the Shroud, by any of the other forces that were pressing against the city’s defenses from every direction.
“Zero trust,” Quill said, when Wren described the system she intended to build. “It is a security model — not common in the Citadel, but documented in some of the older treatises in the Library’s restricted sections. The core principle is simple: never trust automatically. Always verify. Every person, every device, every request for access must be checked, every time, regardless of who is making the request or where they have been before.”
“Exactly,” Wren said. “We have spent weeks reinforcing the city’s outer defenses — sealing doors, building barriers, evacuating districts. But we have been assuming that the inside of the city is safe. That once someone is past the outer walls, they can be trusted. But Vale was inside the city. Vale was the Chief Archivist. Vale was one of the most trusted people in the entire Citadel, and he was the one who corrupted the Founding Laws and directed the Shroud against our walls. If we cannot trust the person who was supposed to be the guardian of our knowledge, we cannot trust anyone automatically.”
The verification checkpoint that Wren established at the midpoint of the Span of Accord was not elegant. It was a collection of hastily assembled barriers and hastily trained volunteers and hastily written procedures that Quill had drafted in a single sleepless night. But it worked, because Wren had designed it around a simple and absolute rule: no one crossed without answering the three questions that Thread had taught the door of the Restricted Archive to ask.
Who are you? Prove it — not with a word or a gesture, but with evidence that could be independently verified. A token, a seal, a recognition pattern that the bridge’s own mechanisms could check against the city’s records.
What are you authorized to do? Show your access level. Show your need. If you are a scholar, explain what you are researching and why it requires passage. If you are a merchant, present your cargo manifest and your trading license. If you are a magistrate, state your business in the Library and provide the name of the person you are meeting.
And — this was the question that caused the most protest — what else is true about you right now? Why are you crossing at this hour, in this direction, under these circumstances? If something about your answers does not fit — if you are an archivist who never works nights, presenting yourself at midnight with no explanation — the bridge will not let you pass, no matter how convincing your credentials or how distinguished your title.
“You are asking us to justify our presence in our own city,” one senior scholar complained, her voice sharp with indignation. “I have been crossing this bridge since before you were born, child. I have forgotten more about the Library than you will ever know.”
“That may be true,” Wren said, and her voice was calm — calmer than she felt, but she had learned, over weeks of crisis, that anger was a resource to be spent carefully and not on people whose complaints were about pride rather than survival. “But the Shroud does not care how long you have been crossing the bridge. The Shroud does not care how much you know about the Library. The Shroud will use you — or your identity, or your access — to reach the Library if it can find a way to do so, and the only way to prevent that is to verify every crossing, every time, without exception, forever.”
The system held for three days before it caught something.
A merchant — a spice trader named Aldrin who had been crossing the bridge twice a week for thirty years — presented himself at the checkpoint with the usual tokens and the usual manifest and the usual calm, familiar demeanor. The bridge’s mechanisms checked his credentials and found them valid. The volunteer on duty checked his answers to the three questions and found them satisfactory. And then Thread, who had been observing the checkpoint from a shadowed alcove on the Library side of the bridge — because Thread observed everything — stepped forward and said, very quietly: “Ask him why he is carrying a second set of tokens in his left sleeve.”
The merchant’s face went pale. The volunteers searched him — politely, professionally, with the procedures that Wren had drilled into them over the past three days — and found, concealed in the lining of his left sleeve, a second set of credentials. They were authentic — genuine tokens, genuine seals, genuine authorization stamps — but they belonged to a different person. An archivist named Loral, who had not been seen in the Citadel for three weeks. Whose disappearance had been noted but not yet investigated. Whose identity had been stolen, piece by piece, by someone who had been planning to use it.
“Aldrin” — or whoever he really was — was taken into custody by Penric’s magistrates, and his interrogation revealed what Thread had already suspected: he was one of Vale’s recruits, a person whose debts or ambitions or vulnerabilities had been leveraged into cooperation. His mission had been to cross the bridge, enter the Library using Loral’s stolen credentials, and retrieve a specific set of texts from the restricted stacks — texts that Vale needed for the next stage of his plan, whatever that plan was.
The system had worked. The three questions had been asked. The second set of tokens would have been caught eventually — the bridge’s mechanisms were designed to flag discrepancies between the credentials presented and the person presenting them — but Thread’s observation had caught it sooner, before Aldrin could cross and disappear into the Library’s infinite halls.
“Assume breach,” Thread said later, when the fellowship gathered to review the incident. “That is the other half of zero trust. You do not simply verify everyone at the gate and then assume that everyone inside is safe. You design the inside as though an attacker is already there. You segment the spaces, you limit the access, you monitor the behavior, and you assume — always — that somewhere, somehow, the outer defenses have already been breached.”
“So we treat the Library like we treat the bridge,” Wren said. “Every corridor. Every shelf. Every restricted section. Everyone who enters must be verified, and everyone who moves between sections must be verified again. No one gets to move freely through the Library just because they got through the front door.”
Quill was already writing — drafting the procedures, citing the precedents, building the framework that would turn Wren’s instinct into policy. “It will slow things down,” he said, without looking up from his codex. “Every verification takes time. Every checkpoint adds friction. The scholars will complain — they are already complaining — and the merchants will complain louder.”
“Let them complain,” Wren said. “Friction is not the enemy. Friction is what happens when you actually check whether someone is who they say they are. The old system — the open bridge, the unlocked doors, the assumption that everyone inside was trustworthy — was frictionless, and it let Vale corrupt the Founding Laws for months before anyone noticed. I would rather have complaints than have the Library compromised because we were too polite to ask someone to prove who they were.”
By the end of the week, the zero-trust framework had spread from the bridge to the Library and from the Library to every other critical institution in the city. The Archive of Record now required verification at its entrance and at every restricted section within. The Spire’s access controls, already strengthened by the split-key system and the contextual checks, were tightened further: even after entering, every visitor was re-verified at each internal door, each gear-chamber, each level of the tower. The maintenance tunnels, once open to anyone who knew where to find them, now asked questions at every junction — not to block passage, but to ensure that the person passing through was supposed to be there.
It was inconvenient. It was slow. It generated an endless stream of complaints and an even more endless stream of paperwork. But it was working, and that was what mattered.
“The old world is gone,” Wren said to the fellowship on the last evening of the week, standing on the Span of Accord and watching the checkpoint volunteers process the evening’s last few travelers. “The world where we could trust everyone who looked like they belonged. The world where we could leave the bridge unguarded and the doors unlocked and the shelves open to anyone who walked in. That world let Vale do what he did. That world let the Shroud advance to within sight of the Inner Ward. We cannot go back to it, even if we wanted to.”
“What kind of world are we building instead?” Kip asked.
Wren watched a scholar present her credentials to the checkpoint — three questions, three answers, three forms of proof — and then pass through, her passage logged and verified and recorded. “A world where trust is not assumed,” she said. “It is earned. Every time. By everyone. Forever.”
She turned away from the bridge and began walking back toward the Inner Ward, where the next crisis was already brewing and the next set of decisions was already waiting. The Shroud was still advancing. Vale was still plotting. The city was still fighting for its survival, one day at a time. But the bridge was guarded now — not with walls, not with weapons, but with questions. And questions, Wren had learned, could be the strongest defense of all.