That night the operations room became a controlled experiment.
Aisha refused to switch off auto-reserve across the network. Victor would be right to say that doing so could create new liquidity risk. They selected a small cohort instead: twelve agents, thirty borrower profiles, two recycled-number cases and a control group.
Wekesa projected the change ticket.
“Pause the reserve rule for thirty minutes. No other configuration changes.”
Njeri from finance control sat behind him.
“If settlement destabilizes, immediate rollback.”
“Agreed.”
At 1:50 they reset the counters.
At 1:58 the control group began its normal reserve cycle. The test cohort did not.
At 2:03 the repayment dashboard remained flat.
At 2:07 the control group showed a spike.
The test cohort did not.
“Borrower files exist,” Wekesa said. “But no source funds are being classified as payments.”
At 2:11 the operator console displayed **performance threshold unmet**.
Two minutes later an emergency journal file appeared in the shared folder.
“This is not the rule engine,” Wekesa said.
Aisha stopped everyone from running it.
“Preserve metadata first.”
The file contained reserve allocations matching the disputed cohort, including Mama Atieno's borrower ID.
Njeri said emergency correction files were routine.
“Then the maker-checker path should be routine too,” Aisha replied.
The request had been sent to an account tagged `EXEC-OPS`.
“COO office,” Njeri said.
“An account is not a person. Check the credential history.”
Eighteen minutes into the test, one conclusion was defensible: pausing auto-reserve reduced the reported repayments attributable to reserve journals. Genuine customer repayments still arrived. The system had not stopped functioning.
Then the approval request was overridden.
Wekesa froze.
“Checker bypass.”
The credential label was `V.ODEDE-EXEC`.
Aisha asked IT security to verify the managed-device record, clock synchronization and MFA assignment. The login came from a corporate laptop assigned to the COO office using Victor Odede's registered authentication token.
That still did not provide a camera image of who sat at the keyboard. Aisha recorded the attribution level precisely: credential and device evidence consistent with Victor's account use.
They repeated the control check. Normal customer repayments continued while the test cohort remained without reserve-generated entries.
The journal-file hash was unchanged before and after the override. No one had altered the test artifact in the room.
Njeri began a summary: “Auto-reserve causes KPI inflation.”
“Change it,” Aisha said.
Njeri groaned.
“Write: ‘In this test cohort, pausing auto-reserve reduced reported repayments sourced from reserve journals.’”
“You murder every useful sentence.”
“I make it survive lawyers.”
They also captured the current permission matrix. Executive emergency authority could bypass a checker in defined circumstances, but the reason code had to be documented. The disputed override had a blank reason field.
The issue was not simply that Victor possessed authority. It was how that authority entered customer-repayment reporting without the safeguards policy itself expected.
Victor entered the room without his jacket.
“Who authorized this test?”
“The change ticket is on the screen,” Aisha said.
“Auto-reserve is approved liquidity management.”
“Then the approval chain will show that.”
He looked at Wekesa. “Release the executive journal.”
“Checker requirement was bypassed,” Aisha said. “It stays pending for review.”
“That's an instruction.”
Aisha moved the keyboard away from Wekesa.
“And that is why we review it.”
After Victor left, the team closed the test with before-and-after counters, rollback status and a list of witnesses. Njeri signed as finance witness even though she disagreed with some interpretations.
A record containing visible disagreement was stronger than a report written by Aisha alone.
The first question had been why a dead woman appeared to repay a loan.
Now the system showed a second question.
After the test, internal audit asked whether the cohort had been chosen because Aisha already knew it would fail. She produced the selection criteria written before execution: recycled-number cases, reserve-linked repayments and matched controls. The criteria had been timestamped with the change ticket. That protected the experiment from becoming a demonstration designed after the answer was known. Njeri added that the control group had experienced no service interruption. Wekesa stored the log package in the review vault, where neither Aisha nor Victor could edit the files without leaving a revision history.
Why had the COO's credential tried to force that repayment back into the dashboard?