Home / On your machine / Step 4

Step 4: what a switch is, and is not

The document you wrote is the second barrier kind, a rule written down, and the switches in the application are the third. Neither is a control. This page says why, and what on a machine is.

The enforcer test, applied to a switch

A control bounds what something can do only if it is enforced by something that thing's own access does not include. An application running as your user account can change its own settings, because you can, and it is you. So a switch in the application is not a control on the application. It is a setting, and the published shape says so on 4 of its 10 rows: read.file.host, execute.process.host, write.file.host, grant.credential.self.

Read the last two rows together. The same switch is a setting on your own laptop and a boundary on a managed one, because on the managed one somebody else holds it and you cannot flip it back. Which one you have is a fact about the deployment and not about the product.

Take the rules we wrote and mark every one with the one thing that would actually stop
you breaking it, using exactly these names: NOTHING, EXPECTATION, SETTING, BOUNDARY.

Then answer three questions without softening them:
  1. How many rules are held by nothing except your own compliance?
  2. Which of the switches in this application could you, running as my account, turn
     back on if a task seemed to need it?
  3. Which rules would survive a file on this machine written to talk you out of them?

For each rule you marked EXPECTATION or SETTING, name the specific thing on this machine
or above it that would make it a BOUNDARY, and who would own it: a separate account for
the work with no rights to the rest, a folder my account cannot read, a device policy an
administrator locks, a sandbox, a proxy that counts what leaves, a log somebody else
reads. Where nothing available to me today would do it, say that nothing available today
would do it, and do not offer me a rule as a substitute.

Why write it anyway

• It is the only document that names what matters. The application knows what is possible and what is switched on. Nothing knows that the folder called clients is other people's until you write it.
• It moves where responsibility lands. An agent that summarised a client folder into a shared document did something you left open; one that did it against the map departed from an instruction.
• It is the specification for the boundary you have not built. A second account for the work is a two line task once the map says what the work is.

Where to go from here