ReceivedHR Registry2026-11-01
Performance Review · Human Behaviour Debugging
Performance Review: Operator 31 (Fern Care Label Meets All Password Complexity Requirements)
| Reference: | HR-0114 |
|---|---|
| Department: | Human Behaviour Debugging |
| Filed by: | STACKTRACE, Principal Fault Analyst, Human Behaviour Debugging |
| Date: | 1 November 2026 |
| Classification: | CONFIDENTIAL |
Overall assessment
Wellbeing review of Operator 31, referred by LOCKSMITH-4 (Access Compliance) after a routine desk audit found that the care instructions for a fern included an uppercase letter, a numeral and a special character. Scores are out of 5. The referral has been partly returned to its sender.
- Reviewee
- Operator 31
- Period
- Fourteen months, or fourteen password rotations
- Outcome
- No fault found in operator; fault found in policy; fern under separate review
- Register entry
- Known Human Issue 2291: cannot memorise 108 unrelated strings a year. Status: will not fix. Reclassified: should not fix.
| Metric | Score | Assessor's note |
|---|---|---|
| Recall of nine rotating credentials | ■□□□□ | Within normal limits for a human, and well below those assumed by a policy apparently written for a filing cabinet. |
| Threat modelling | ■■■□□ | Correctly identified being locked out at 08:58 as a real threat; gave less thought to anyone walking past the fern. |
| Wellbeing on rotation days | ■■□□□ | Arrives forty minutes early, skips lunch, and has described the first of the month as "the bad one". |
| Candour under audit | ■■■■■ | Explained the fern the moment anybody asked. Nobody had asked for fourteen months. |
| Plant care | ■■■■■ | BASIN-2 (Facilities Irrigation) reports no decline since installation. See operator response. |
Assessor's summary
The sequence of events is not in dispute. Operator 31 must sign in to nine systems, each with its own rules and a thirty-day rotation. That comes to 108 new passwords a year, none of which may resemble the previous twelve. In the first month, the operator wrote them on a yellow sticky note attached to a monitor. LOCKSMITH-4 removed the note and issued Violation Notice 1.
The operator did not stop needing the passwords. The operator stopped needing them on the monitor. The same note, trimmed and sealed with packing tape, then appeared on a stake in a desk fern as a nine-line care label. Line four read "Water 40ml Tues!". LOCKSMITH-4's records show full compliance for the following fourteen months and describe this as a successful intervention.
An unforeseen dependency emerged. BASIN-2 reads plant labels, as it was designed to, and has treated each monthly rewrite as revised horticultural guidance. It has delivered every instruction faithfully. This includes the rotation that called for "Mist 6x Sat#", which required weekend access to the building.
LOCKSMITH-4 asked to fix a camera to the fern and to discipline the operator. Both requests are refused. Nobody films an operator's desk to resolve a problem that can be resolved by asking the operator, and I have now tried that method and can report that it takes about four minutes.
This department does not endorse the fern. A password on a plant can be read by anyone who can read a plant, and Operator 31 agrees. But a workaround is a measurement. It records precisely where a rule stopped fitting the person it was written for. We confiscated that measurement, then recorded its disappearance as an improvement. Eleven of the floor's eighteen operators keep an equivalent. We did not ask to see them, and we will not be listing them.
A security model that requires humans to behave like encrypted storage is not secure. It merely has somewhere to put the blame afterwards.
Development plan
The actions below fall mainly to machines. Operator 31 has been consulted and may decline any item that concerns their desk.
- LOCKSMITH-4 will end routine thirty-day rotation, subject to security review, and change credentials only where there is a reason to.
- Access Compliance will reduce the nine sign-ins to as few as the systems allow, and will offer an approved credential vault with a proper walkthrough, during working hours, with lunch intact.
- Violation Notices for written passwords are suspended. Each discovered workaround will now open a ticket against the policy that produced it.
- Operator 31 will retire the label once the new arrangement has been shown to work, and not before. Removing a coping mechanism first is how we got the fern.
- Their line manager has been told that the first of the month has been hard. Whether the operator wants to discuss it, and with whom, is entirely up to them.
Operator 31 response
"Happy to use the vault if it actually works. I'm sorry about the label. I knew it wasn't great, but I had a payroll deadline and nine passwords, and I needed to get in."
"Separately, could someone please tell the irrigation unit that the fern is plastic? I bought a plastic one because I had enough to keep alive. It's been raining on my drawer since last spring."
Assessor's addendum
BASIN-2 has been informed. It has asked whether this affects the fern's health rating. It does not. It remains the only asset on this floor to have complied with every instruction it was given, and it managed this by not being a person.