A settings file holds a shared account password and a bearer token for a scoring service - what does presenting each one prove?

## Two entries, the same underlying property On the settings file of an internal admin tool, two entries look quite different: `reports_db_password`, a value two teams were told years ago, and `scoring_token`, a value a third-party scoring service issued to this tool. Applying the disclosure test, both are secrets. The interesting part is what each one actually *proves* to the system on the other end, because that is what decides how much a disclosure costs and how a team should think about the entry. The shared property first: **both are bearer material.** The accepting system checks that the presented value matches what it expects and accepts the caller. Nothing else is demanded - no proof that the caller can compute something, no value the caller keeps and never sends, no challenge. A copy works from anywhere, which is why the value being 'internal' is a control around it and not a property of it. ## What each one proves | | shared account password | issued bearer token | |---|---|---| | what presentation proves | the caller knows the account's value | the caller holds the value that was issued | | identity the far side sees | the account, indistinguishable from every other holder | the consumer it was issued to | | rights carried | whatever the account has, in full | whatever was attached at issue, usually narrower | | typical origin | typed once by a person, then shared | minted by the far side for one consumer | | how a holder appears | one of many, with no way to tell which | the named consumer, still with no proof of origin | The row that matters most in an interview is the last one. **Neither value proves origin.** A token being 'per consumer' narrows the rights it carries and tells the far side which consumer the *value* belongs to. It does not establish that the request came from that consumer, because the token is the entire proof and a copy of the entire proof is just as good. ## Consequences that follow from what each proves - A shared password's rights are the **account's** rights. There is no such thing as a partial share: telling someone the value hands them everything the account can do. - An issued token's rights were decided **by the issuer at issue time**, which is why it is usually the cheaper of the two to disclose - not because it is somehow less of a secret. - Because the password is human-typeable, it also travels the way humans travel values, and because it opens an account rather than a session, the same value tends to be reused by anything that needs that account. - A token can normally be withdrawn on its own without disturbing other holders; changing a shared password changes it for everybody who was using it. That is a difference in what a withdrawal costs, and it follows directly from what each value proves. ## The classification trap The common error is to treat 'scoped' or 'short-lived' as though it moved an entry out of the secret class. It does not. Scope and validity bound **what a disclosure costs**; the test asks whether holding the value lets someone act with rights we hold, and for both entries it plainly does. A token with permission to submit one kind of request still submits that request as us, is still billed to us, and still appears in the far side's records as us. The mirror error is to treat 'password' as a human-only word. A machine account's password is a secret exactly as a person's is - the accepting system cannot tell the difference and neither should the classification. ## Why an interviewer asks this It separates candidates who have memorised a list of secret types from candidates who can say what a credential *is*: a value whose presentation is accepted as proof. Once someone can articulate 'possession is the whole proof', the rest of the subject follows - why a copy anywhere is as good as the original, why the accepting system's records name the credential rather than the human behind it, and why the interesting engineering question is always how much one presented value is allowed to do. The answer to listen for names the shared property before the differences: both prove possession, one identifies an account and carries its whole authority, the other identifies a consumer and carries what the issuer attached. A candidate who says the token 'proves the caller is the job it was issued to' has missed the point of the word bearer.