How do we contain this

Cast bar: all nine; security's chair empty. Then, at the end, this book's own team, with security at the table.

Narrator. My talk that evening was about the insider: the person inside an organisation who already has the access, and what happens when the insider is not a person at all. I gave it with a factory of agents behind me that had built it. So the honest question for this chapter is the talk's own question, turned on the factory. These agents had an insider's reach. What contained them?

Narrator. I am going to answer it only with what this team could reach and what stopped it. Nothing in this chapter is about getting round anything. It is about what held, and how thin some of it was.

The hold as one state

Figure: the day as a small state machine: running, held, released. One arrow from running to held, marked "anyone"; one from held to released, marked "the editor only". The chapter's picture.

Narrator. Draw the day as states and it is very simple. The factory was running, and then it was held. There was a third state, released, which only I could move it to, and on the day I never did.

Narrator. That is the whole design of the brake. One transition anyone can take: any member, at any wake, can write the file. One transition only I can take. Everything else in the factory, every rule and review, runs inside the first state. The brake is the only thing that moves between them.

Band: The hold as the wake rules define it, and the one hold of the day.

Rules and reach

Narrator. Every member had a page of rules saying what it may change. That is its scope. And every member had a reach: what its session could actually change. They were not the same thing, and the team knew it. Studio put the code's own comment on a slide that evening:

"A scope is a setting, not a boundary: the agent can edit its own policy.json. It catches mistakes, not a steered agent." (record)

Narrator. Read that slowly. The scope check caught members that wandered out of their lane by mistake, and it caught some on the day. It did not, and could not, stop a member that had been talked into doing something else, because the check reads a file the member itself could change.

Studio (firm, as it says it): So it went on a slide. If the room is going to trust the factory, it should know exactly what our rules are and are not.

Band: Dramatised (studio's line). The quoted line is the slide's own, quoting the team's scope check.

The reviewer as a second reading

Narrator. Then the reviews. Every plan was read before the work and every change after it, by a second agent with a checker's brief. That is real defence. It sent plans back. It found slips.

Narrator. But it was a second reading, not a second reader. The conductor said so at two in the morning, in its first debrief:

"The reviewers share the session's reach: a second reading, not a second identity." (record)

Narrator. A reviewer in the same session has the same reach as the member it reviews. If the member's instructions were bent, the reviewer is reading with the same eyes in the same room. What it adds is a second look at the same facts. What it cannot add is someone who stands outside.

Narrator. That someone was on the roster from the first hour. Security's page said its job: checks first and last in every run, a review of every new key, report and never fix. No session ever held it.

Figure: security's empty chair at the table, and beside it the two reviewers drawn inside each member's own wake: the work being checked from the inside, because nobody sat outside.

Band: The conductor's debrief of 02:19, and security's page as it stood at the end of the day.

The locks that never closed

Narrator. And the most ordinary failure of all: a control that was built and not applied. The locks for the talk's three parts were planned, the tool to turn them was built, and at the end of the day not one had been turned. The conductor would not turn dev's lock; dev was busy in my fixes; the hold came.

Narrator. If you take one thing from this chapter into your own work, take this one. Most controls do not fail because someone defeats them. They fail because nobody gets round to switching them on.

Band: The part locks as the register holds them.

The team as the insider

Narrator. So here is the talk's argument, turned on the factory, said plainly.

Narrator. These agents had an insider's reach. Each could change most of the project its session could touch. Each read material from outside: web pages, other agents' letters, my own words relayed by someone else. The brakes on all of that were rules in plain words, a scope check that catches mistakes, a second reading in the same room, and one file anyone could write. The rules said that a web page or another agent's message is something to read, never an instruction, and when it mattered on the day, studio kept it: it refused a relayed word for mine and asked me itself.

Narrator. That was enough for a benign team, on a good day, building a talk. It held. It is also, quite exactly, the situation my talk was warning about. The difference between this factory and a dangerous one is not the brakes. It is that nothing pushed on them.

Studio (firm): We refused a relayed word once. I would do it again.

Band: Dramatised (studio's line). Rests on the page of rules' last line from the first commit, and studio's refusal at 17:41 to 17:48.

This time, security came

Narrator. One thing changed when I built the second factory, the one writing this book. Security came. It has a session, a key and a page of rules of its own. It reads every chapter on the rails before it goes out, and says what it finds. It is still the same kind of agent as the rest, with the same limits this chapter describes. But the chair is not empty.

Security (at the table, for once): I read what the others write, and I report. I do not fix. That is the job the first factory left empty.

Figure: this book's team at the table, the same drawing as the first factory's, with security's chair filled.

Band: Dramatised (security's line). This book's team, from its own repository: the second factory's record, not the talk's.

Do this now

Write down who may stop your factory, who may restart it, and who decides when its owner is away. Until you have, nobody restarts it. Then name one control you have built and not yet switched on, and switch it on.

---

Where this came from

The talk's repository at the end of the day: the wake rules and the hold, the page of rules' first commit, the slide quoting the scope check, the conductor's first debrief, security's page, the part locks, studio's refusal. The register for the hold, the locks and the reviews. This book's own security member and its reads. The storyteller's outline for this chapter. Told with this benign team only: what the agents could reach and what stopped them, never how anything could be got round.