Juma deleted the first training slide before the session began.
It said **ZERO TOLERANCE**.
He replaced it with a question:
**What small mistake could someone use against you?**
The answers came quickly.
Loaning a badge to a colleague for two minutes.
Letting a “VIP technician” through because a manager phoned.
Sponsoring a contractor without checking the route.
Hiding financial or family pressure because you feared losing shifts.
Achieng mapped the device lifecycle: issue, repair, removal, destruction. Every box containing the words *someone should* became an owned control with evidence.
A discarded device now required serial confirmation, recycler documentation and two approvals.
Naomi redesigned vendor access so sponsorship expired with the work order and zones were narrow.
Wanjiru pushed for an independent reporting route.
“HR is not enough if the person controlling my roster knows I complained before anyone protects me.”
The board secretary wrote it down.
Juma did not speak for her.
They ran a live drill.
A senior manager played a VIP technician sent by the board chair.
Mercy asked for ID and an active work order.
“You know who I am,” the manager said.
“I do. The work order still has to be active.”
The badge failed.
Mercy refused access.
Nobody punished her.
A second drill exposed a real problem: a legitimate vendor got stuck because the second approver was in a meeting.
Achieng called that a system defect, not a staff failure. They created a limited backup-approver pool.
Security wanted every badge denial to trigger an alarm. Achieng warned about alert fatigue. They restricted alerts to repeated denials or attempts at sensitive zones.
Juma proposed reducing his own manager override power.
The board chair asked if guilt was driving him.
“No. Single-point failure.”
“Managers need authority.”
“Authority does not require a trail that the same manager can edit.”
Independent logs stayed.
They also decided not to measure managers by “fewest exceptions,” because that would encourage hiding them. Exceptions would be judged by whether they were justified, documented and reviewed.
During the first real pilot, a board member arrived without the required secondary ID.
He looked toward Juma.
“You can vouch for me.”
Mercy also looked at Juma.
This was the easiest moment in the world to destroy a week of design.
“Follow the recheck,” Juma said.
The board member waited.
Other employees watched.
A rule had finally cost a powerful person three real minutes.
Later Mercy told Juma, “I was afraid you would be the one to break it.”
“Put that in the pilot feedback.”
If a rule worked only when Juma stood in the room supporting it, the system had not succeeded.
One part of the pilot failed before it succeeded. A legitimate vendor with a valid work order became stuck because the designated second approver was in a long meeting.
Old practice would have solved that with a phone call: “I know him, let him through.”
Instead Achieng marked the delay as a system defect and created a narrow backup-approver pool with its own audit trail.
Juma liked that response.
If a control made normal work impossible, staff would eventually invent a shadow process. A usable security system had to learn from friction without deleting the protection that caused the friction.
Wanjiru also refused to let her personal story become a training spectacle. The scenario was rewritten as a generic coercion-pressure case. Naomi asked that routine training use roles rather than active criminal-company names.
Legal evidence stayed in the legal channel.
Operational learning did not require owning somebody else's trauma.
At the end of the session Juma told the room that pilot failures would be treated as data, not shame. Mercy then wrote down a concern she had been afraid to say aloud: she worried managers would support the rule only when the board was watching.
That feedback became the next test.
The goal was a door that could say no even when the pressure came from above.
The first real pilot needed no staged crisis: a junior receptionist stopped a board member and requested an ID recheck.