Who may act, and who may know

Part 2 ended on a worry. If the answers to the seven questions get shared earlier and more widely, who gets to see them, and who gets to act on them?

It’s the right worry. The usual reason for walls between teams isn’t stubbornness. It’s that some information is dangerous in the wrong hands, and some changes are dangerous by the wrong hands. “Share more” has to come with an answer to both.

Mine comes in three parts.

Knowing and acting are two different things

Most places bundle them. You can see a finding if you own the system it’s on, and if you can see it, you’re expected to fix it. Everyone else sees nothing.

Pull them apart and it gets easier.

Least privilege is fifty years old and still right. What changes is the job. If the job is “make a good decision about this finding, early”, then the people who hold the answers need to see the question, and the people making the call need to see the answers. That’s more knowing than most places allow today, and no more acting.

Every answer is a claim someone stands behind

In part 2, the seven answers came from five different groups. “It’s already patched.” “The firewall blocks it.” “Nothing calls that function.” Each of those is a claim. The question is who’s making it, and what it rests on. I think about it in three levels:

Two rules follow. First, a claim has a name on it: a person, so there’s someone to go back to. Second, a claim expires. “Not reachable” was true until someone opened a port last Tuesday, so the decision should know how old its answers are.

That’s the receipt from part 2, doing its real job. It isn’t paperwork. It’s how the person who owns the call can show what they relied on, and how you find out later which sources keep being wrong.

Some things stay need-to-know

Not every answer is harmless. The details of an open, unfixed flaw on a sensitive system are a map for an attacker. Part 2½ made that sharper: a brand-new flaw with no public fix is the most sensitive thing on the list.

So share in layers.

That’s the honest answer to “won’t sharing more make us less safe?”

Those are different things, and treating them the same is how sharing gets blocked for good.

A made-up example

Here’s how it might look for one finding: a flaw in a library used by a customer-facing system.

The last row matters more every month. Agents will do more of the looking up, and they’re good at it. The same rules apply to them, a bit stricter: an agent can know a lot, act very little, and never be the name on a claim. It shows its sources and leaves a receipt, like everyone else.

The catch

More people knowing is more to manage → Who can see what has to be reviewed, like any other access. Otherwise “need to know” quietly becomes “everyone who ever asked”.

Names on claims can feel like blame → If putting your name on “it’s patched” means getting punished when it turns out wrong, people will stop saying anything. The point is to find the bad sources, not the bad people.

It can look slower at first → Writing down who stands behind an answer takes a minute. It saves the week spent later arguing about who said it was fine.

Regulators tend to like this → Separation of duties, a named owner for each decision, and a trail of what it rested on are exactly what audits look for. Sharing the answers isn’t loosening control. Done this way, it’s showing it.

Where to start

Take the seven questions from part 2. For each one, write down four things where you work: who can see the answer today (and who should), who can act on it, whose name goes on it, and how long it stays good.

You’ll probably find answers that nobody’s name is on, and people who can act but can’t see. Those are the first things to fix.