Chapter 78: Cloned
The visitor identifier had been copied inside Mercer Nova.
Two days after Nathan's interview, the external auditor completed the reception-source review. We met at a forensic station separated from the live system. The display contained event classes and custody references, not instructions someone could use to duplicate a badge.
The original credential ended at Nathan's checkout.
A second record carrying the same identifier appeared later under a different issuance event.
The reception system had accepted both because the copied record preserved the original visitor label. That was why the transfer manifest displayed Nathan's name.
The two records did not share a custody event. The first belonged to the legal meeting and ended at reception. The second began during laboratory commissioning, after the original should have ceased to exist. The gap prevented Sterling from describing the later use as Nathan simply forgetting to return a badge.
"Was the physical badge copied?" I asked.
"The evidence proves the identifier was duplicated," the auditor said. "It does not establish the method or the object used."
Nathan had not appeared at the laboratory. His itinerary supported that. The copied identifier explained how his name could enter our records without his body.
It did not make him innocent of the choices already documented at Sterling.
One false accusation removed from this incident did not erase a signed migration chain, a vendor invoice, or the instruction to remove my name. I kept those records separate.
The auditor traced the duplicated issuance to Mercer Nova's internal reception environment. No Sterling system had created it. Someone with access inside our company had enabled the credential to exist again.
The source event occurred before the unauthorized schedule change. It did not prove the same person performed both actions, but it showed the duplicated identifier had been prepared rather than improvised at the storage terminal.
Julian read the classification at the same time I did.
"Lock every reception role," he said.
"They are already locked under the external order," the auditor replied.
He stopped speaking.
The correction was small and important. His authority did not become useful merely because the threat had moved inside his walls.
The reception-role list included full employees, temporary support, and one contract administrator assigned during laboratory commissioning. The auditor eliminated roles that could view a visitor label but not initiate an issuance event.
Three remained.
Two belonged to reception supervisors whose independent activity records placed them away from the system. The third belonged to the contract administrator.
That did not yet prove the administrator created the duplicate. Shared process requests, delegated work, or misuse still required examination.
The contract role had been created for commissioning convenience. It could see reception labels because vendors needed temporary access and could request schedule coverage when permanent staff trained new teams. Each permission had an ordinary reason. Together, they formed a path no single employee should have held.
Julian ordered no redesign while the audit remained open.
"Preserve the failure before we fix it," he said.
The external auditor approved temporary controls that blocked use without rewriting the historical role.
"Do we suspend the person?" Julian asked.
"Their access is already disabled. Employment action belongs to a separate process."
"Then preserve pay, contracts, assignments, and communications."
The auditor added those sources.
The project team wanted to restart once Nathan's physical absence was clear. I refused.
"We know the label was copied," I said. "We do not know whether the schedule change and storage transfer were the only uses."
The independent safety observer agreed. Work would resume only after all related access paths were reviewed and the isolated materials were cleared.
That cost another week.
The team recorded the delay against management planning, not against the scientists whose work waited. No one lost a performance mark because a security control required time.
The copied credential remained a security failure, not a scientific shortcut.
At the end of the session, the auditor issued a limited finding:
NATHAN COLE NOT PLACED ONSITE BY VISITOR EVENT.
DUPLICATED IDENTIFIER ORIGINATED WITHIN MERCER RECEPTION SYSTEM.
The first line narrowed blame.
The second moved the investigation across the glass.
On the active-access shortlist, one role still belonged to someone working inside the company.