Least Privilege, Most Drama: What Two Short Stories Get Right About Access Control

Most fiction gets security wrong. Hackers type very fast, a progress bar fills up, and someone says "I'm in." Real security failures are slower and much more human. A shared password on a sticky note. A file that suddenly requires a password nobody explained. An admin account that outlived the person who used it.

I recently read two short stories on TaleHour that get this right, and neither of them is a techno-thriller. They are family and workplace dramas where the plot turns on who has access to what. If you work in IT, security or ops, you will recognize every beat.

Story 1: The HR Server and the Sticky Note

In A Sticky Note on My Monitor Locked Me Out of My Own HR Server, Barbara has run HR systems at a peach-packing company for years. A sensitive accommodation list leaks: names, health conditions, the quiet arrangements made for employees with bad backs or medical treatment. Within days, eleven employees get creepy texts from a "workplace wellness" app that knows exactly who they are.

Her new boss, Troy, calls her a "data security risk" in front of the management team and hands her a Performance Improvement Plan. "Legacy habits create legacy vulnerabilities," he says.

What I loved, as someone who has sat through a few post-incident reviews:

• The accusation is based on ownership, not evidence. "Your server. Your methods." That is how blame often works before anyone pulls logs.
• The real story is in the access trail. The sticky note in the title is not a throwaway detail.
• The ending is a security control. I will not spoil it, but the last paragraph involves an MFA prompt, and it is one of the most satisfying endings I have read in a while.

Story 2: The Password-Protected Payroll File

My Husband Locked Me Out of the Payroll After 30 Years starts with a small technical change that every sysadmin knows is never small: a file that was always open is suddenly password-protected.

Al has kept the books for the family restaurant for three decades. Payroll is due by noon. Her husband, who "couldn't have told you what a payroll liability account was," pulls the laptop to his chest and says their insurance guy recommended fewer people see employee data.

On its face, that is a reasonable least-privilege argument. The drama comes from the fact that the person being removed is the only one who actually knows how the system works, and the person adding the control has reasons of his own. It is a perfect example of a security policy used as cover.

The Patterns Behind Both Plots

Read as case studies, the two stories share a few patterns worth naming:

1. Controls can be weaponized. Access restrictions are good, until they are introduced suddenly, by one person, with no change log. In both stories, the "security" change is the first red flag.

2. Blame follows the org chart. Whoever owns the system gets blamed first. Good investigations start from logs, not titles.

3. Domain experts get removed first. The people who would notice anomalies are exactly the people an insider wants out of the loop.

4. Audit trails win. Both heroines resolve things by reconstructing what actually happened from records: deposits, logins, files. No dramatic hacking required.

Why This Matters Outside Fiction

Stories like these are useful for engineers because they show the social side of security that rarely makes it into runbooks. Questions worth borrowing for your next access review:

• Who requested this restriction, and who loses visibility because of it?
• Is there a record of why it changed?
• If the most experienced person on this system disappeared tomorrow, who would notice problems?

Reading Notes

Both stories are free on TaleHour, around fifteen minutes each. They are written for general readers, not engineers, so there is no jargon to wade through. That is part of the charm: the security lessons arrive through character, the way they usually do in real life.

If you have favorite fiction that gets security, logging or incident response right, drop it in the comments. I am always looking for more.