“Do not change your password yet.”
Achieng Naliaka stopped Juma's hand before he confirmed the reset.
“My account was used.”
“Yes. And if you change everything before I snapshot the token history, you may damage the sequence.”
They stood in the cold server closet behind IT. Halima waited at the door with the incident notebook.
Achieng made Juma write down, from memory, every occasion on which he had used a banquet device.
“Why before you show me the logs?”
“Because memory changes after it sees evidence.”
He remembered a gala the previous month. The VIP lift had failed. He had logged into banquet tablet BQ-17 to issue temporary access. He could not remember logging out.
Achieng compared the account history.
“The timing matches.”
The manager override from tonight had come through BQ-17.
The tablet was supposed to have been discarded after a broken screen. Its asset trail showed **not economical to repair**, followed by **moved to AV store pending disposal**.
No destruction certificate. No recycler receipt. Only one technician's initials where policy required two approvals.
“Whose policy?” Juma asked.
Achieng looked at him.
“Yours.”
They went to the AV store below the ballroom with Peter present. The lock was ordinary and several event supervisors had keys. On the last shelf they found a new tablet charger and the empty box for BQ-17.
The tablet was gone.
Juma started to say they would improve disposal.
Achieng cut him off. “Don't write ‘improve disposal.’ Record the exact failure.”
So he did: no destruction proof, no recycler receipt, single approval, active charger, missing device, accessible storage.
Back in IT, switch logs showed BQ-17 had returned to the network at 00:27 through the temporary event segment. Four minutes later Juma's account issued the master override.
“Could my session token have remained on the device?” he asked.
“Possibly. Could have been cloned. Could be something else. We don't choose until authentication data supports it.”
Juma told Achieng about the gala login. It was embarrassing because it was ordinary. He had been in a hurry and had treated a shared tablet like a trusted manager workstation.
The general manager joined by phone.
“You're declaring a conflict?”
“Yes. My credentials are part of the incident. IT should control preservation. Non-life-safety access changes should require two approvals.”
“That means you lose unilateral manager control tonight.”
“I know.”
The GM agreed.
For six years Juma had considered rapid authority one of his best qualities. Now the same authority had become a weakness because one compromised token could speak with his name.
Achieng took control of the access evidence and placed the AV store under a recorded seal. She told Juma something he did not enjoy hearing.
“This is the control. Not trust in you.”
A live-device scan refreshed.
BQ-17 was absent.
Then it appeared.
“Guest Wi-Fi,” Achieng said.
“Where?”
The nearest access point was in basement parking.
Peter's radio crackled almost at the same moment.
“Juma, shuttle three has started. Dispatch has no trip.”
Juma stood, but Achieng stopped him for one second.
“New rule begins now. I keep the logs. If you find the tablet, you do not touch it.”
He nodded.
Authority had become narrower.
The evidence had become cleaner.
On Achieng's screen, BQ-17 moved onto the basement access point carrying one more uncomfortable fact.
Achieng also reviewed who could enter the AV store. The answer was worse than a single suspect: event supervisors, two engineers, a banquet captain and a legacy physical key that had never been recalled after a role change.
“That does not tell us who took BQ-17,” she said. “It tells us why we cannot responsibly pretend the store was controlled.”
Juma had spent years writing reports that ended with phrases like *staff reminded to follow policy*. He suddenly saw how useless that language could be. A policy that required two disposal approvals meant little if a broken device could sit for weeks in a room with uncontrolled keys.
He and Achieng agreed on immediate containment that would not destroy evidence: seal the store, freeze changes to the asset record, preserve the network history, and require dual approval for access changes.
Peter asked whether they should broadcast that Juma's account had been compromised.
“Not yet,” Juma said. “Staff need instructions, not a rumor with my name attached.”
Achieng gave him a sideways look. “That is the same protection you want for Wanjiru later, if her name appears.”
Juma had not yet met that part of the case, but the principle was already there.
A username was evidence about a credential.
It was not a complete biography of the person whose name appeared on the screen.
Before leaving IT, Juma asked Achieng to preserve a copy of the old disposal policy beside the incident records. Future reviewers needed to see not only what happened but what the hotel officially expected to happen. Otherwise a rewritten policy could make yesterday's failure look impossible on paper.
Juma's manager session token was still alive on it.
On the guest Wi‑Fi map, the tablet carrying Juma's manager session token was live in the basement parking area.