A permission with more verbs than the reason

The grant that was right

On a Tuesday in March at 21:40, Hanadi Naguib needed to correct a size chart before Bardawil Mills' overnight cut-off. The technologist who normally holds the pen was asleep. She asked for edit rights on the style record. Hisham Barakat said yes. The correction took four minutes. That decision was right, and this lesson is not an argument against it.

What the decision could not see is this. The permission she was given is called edit style, and edit style is not one verb. It is fourteen.

A permission is granted for a reason, and it hands over a set. The reason lives in one person's memory of a Tuesday night. The set lives in the system, and it outlasts everybody's memory. Six months later, a different holder of the same role used a different verb. He was being entirely reasonable. It cost money.

Four incidents, and one of them is the point

Wesam Fahim in the sampling room finished a marker for WB-2604 and updated the consumption field from 1.42 m to 1.31 m. His number was right. It was the true consumption of the sample marker he had just made, on a short lay. Writing a measurement into that field is exactly what a sampling room should do.

The field feeds the fabric requisition. Six days later, three purchase orders went to Bardawil off that number, for an order of 24,000 pieces.

The shortfall is 24,000 pieces times the 0.11 m difference: 2,640 m, bought late at the mill's short-order price instead of the contract price. Nothing about that edit was hidden, forbidden or unusual. It was a correct measurement written into a field that answers a different question — what the bulk marker uses, not what the sample marker used.

Three ways to fix it, and the cheapest is not the one people propose

Option one: remove the eight unused verbs. It is free, it takes an afternoon, and it removes a lot of theoretical exposure. It is also the first thing every security discussion reaches for, so be blunt about what it is worth here: all four incidents came from verbs people actually use. Removing the eight prevents none of them. Still do it — potential exposure is real. Just never report it as a fix for something that has already happened.

Option two: narrow the role. Split edit style into four roles, so that consumption, approved colour and status changes sit apart from ordinary editing. That would have prevented three of the four incidents — 2,516.22 of the 2,726.22, or 92.3%.

It also has a running cost, and an honest version of least privilege prices it. Splitting produces about forty-one access requests a year. The average one waits about twenty-two minutes: fifteen hours a year, USD 213.47. Trivial. But three of those forty-one land on a mill cut-off. There the wait is not twenty-two minutes; it is the next day's dye queue, at a line-day of 1,240.00. That is USD 3,720.00 a year, and it arrives as three bad days rather than as a line in a budget.

Option three: make the verb loud. Do not take away the right to change consumption. When the field changes, the record's owner is told at once, by name, with the old value and the new one. Cost per change: nothing. It prevents no incident at all — and it recovers nearly all of the money, because of when the damage happens.

A notification on the day would have caught the two expensive ones before they turned into money: 2,514.72 of 2,726.22, or 92.2%.

92.3% for USD 3,720.00 a year, or 92.2% for nothing. That is the answer, and it is not the one a policy document reaches.

Why catching it is nearly as good as preventing it here, and where it is not

Loudness works on a permission for a specific reason, and the reason does not apply everywhere. A wrong edit to a record does no damage on its own. It does damage when a later decision uses it. There is nearly always a gap — six days, eleven days. Catching it inside that gap is as good as preventing it, and it costs a fraction.

It fails where the use is instant or cannot be undone: money leaving the company, a payment released, a shipment cleared. There the gap is zero, and nothing replaces narrowing the permission before the fact. Price the gap, then choose. Six days of gap buys you a cheap fix. No gap buys you nothing.

The grants nobody ever decided to keep

The audit's real finding was not about verbs at all.

Read the fourteen reasons and every one is good: cover for maternity leave, a season's peak, an external audit, a leaver's handover, one Tuesday night in March. Every grant was right on the day it was made. Not one person ever decided to keep it, because there is no moment at which keeping it comes up. Making a grant is a decision. Continuing one is the absence of a decision.

That is why an expiry date is the strongest control in this lesson, and the least like a security measure. It is a scheduling device: it creates the moment when somebody has to decide again. Tanvara's rule is that a grant with a named temporary reason carries a date, and that date is not a maximum — it is when the question gets asked.

I want to price three different fixes to a permission problem. I do not want to assume that giving people less access is the answer.

Here is the role in question, and every action it allows, written as verbs: [PASTE]. Here is who holds it: [PASTE]. Here are the incidents in the last year caused by someone using it: [PASTE]. For each incident, I have written how many DAYS passed between the edit and the moment it cost money.

1. Mark each verb as used in the last year, or not used. Tell me how many verbs everybody holds and nobody uses. Then be honest with me: removing them prevents none of the incidents I listed.
2. Price splitting the role. Which incidents would it have prevented? What does it cost to run? Give me the number of access requests a year, the average wait, and the WORST case, which is a request landing on a deadline.
3. Price a different fix: telling the record's owner every time it changes. Which incidents would have been caught inside the gap? Use the days column. A loud alert is worth nothing where the gap is zero, so say where that applies.
4. Separately, list every access grant made for a temporary reason. Tell me which ones have no end date. For each, propose a review date, not a removal.

Give me the three options side by side, with the benefit and the yearly cost of each.