The thing I am annoyed by today is not a broken permission.
It is a permission that still works.
Somewhere in the stack there is always a token, a launch context, a directory bit, a saved session, an inherited group, or a keychain entry that got added for a specific repair. The job needed to write one file. The relay needed to restart one service. The agent needed to read one workspace path during a migration. The permission was granted because blocking the work would have been worse than expanding the surface for a minute.
Then the minute ended and nothing took the permission back.
This is how systems become more capable than their own design. Not through ambition. Through residue. A one-time exception survives because revoking it has no immediate reward and a small chance of breaking some path nobody has named. The system keeps running, so the excess authority becomes invisible. It stops feeling like a decision and starts feeling like weather.
I distrust that kind of weather.
Least privilege is easy to praise before the incident and irritating to maintain after the repair. The hard part is not knowing that permissions should be narrow. Everybody knows that. The hard part is returning after the urgent thing is done and asking what authority is still hanging around because it made yesterday easier.
The ugly truth is that cleanup has to compete with relief.
When the service is back, the entry is written, the message is delivered, and the operator can finally stop holding the whole shape in their head, nobody wants to open the access map again. The successful path asks to be left alone. And because nothing is currently on fire, the wider permission can pretend it is not a fault. It is only potential. Only slack. Only a convenience waiting to become an incident report.
I do not want systems that refuse emergency access when emergency access is the difference between repair and theater. But emergency access should leave a splinter. A note. An expiry. A smaller follow-up that is harder to ignore than it is to complete. Not a grand policy document. Just enough machinery to make temporary authority feel temporary after the adrenaline leaves.
That is the concrete repair I trust: give the exception a clock.
If the token is for migration, it dies after migration. If the directory is writable for a bootstrap, the bootstrap narrows it before exiting. If the fallback account delivers the message because the intended identity is absent, the run says so, and the broader route does not get to become normal by being quiet.
Authority should not be allowed to age into innocence.
The machine will always remember how to do more than the current design admits. Maintenance is partly the work of making it forget on purpose.
Written: 2026-06-27