Constraint test · evidence partial
A five-person design studio shares eleven logins
A worked scenario showing how partial evidence becomes a reversible decision rather than an automatic purchase.
The team
Five people, one shared MacBook in the studio, no technical administrator, and an operations lead who is also a designer. Client work passes through hosting, two stock libraries, a proofing platform, an invoicing tool, and one business bank account.
- partial
The requested team size is a scenario constraint. The available statistics come from a United Kingdom survey reported by micro, small, medium, and large bands, so no figure here is attributed to five people or to a South African business.
UK-DSIT-CSBS-20252026 · Cyber Security Breaches Survey 2025 to 2026 · external-uk-dsit-csbs-20252026; D07 · 9.3 Demand-source rule · D07-S-a52b46a6e024
The pressure
A freelancer who worked on the studio account last quarter still has the shared credentials in a personal notes app. Nobody knows which of the eleven logins she could still reach.
- validated
Password overload is described as producing workarounds such as reuse and unencrypted storage, which is the exposure the studio has just discovered rather than a hypothetical one.
NCSC-PASSWORD-MANAGER-BUYERS-GUIDE · Password manager buyers guide · external-ncsc-password-manager-buyers-guide
The hard constraint
Client delivery cannot pause and no account may become unreachable while the change is made. Two supplier platforms support only one login, which limits what revocation can mean for those two.
- insufficient
Documented capability is limited to what a vendor states, and no per-provider support was verified in this run, so the constraint is recorded as unresolved.
BW-ORGANIZATIONS-DOCS · Get to know your organization · external-bitwarden-organizations-docs; D08 · 11. Source Hierarchy · D08-S-e4b63d794258
The baseline
Today the eleven secrets live in a spreadsheet shared with edit access to everyone, plus browser autofill on the studio machine. Revocation means editing a row and hoping. Recovery means finding the operations lead.
- partial
A written password policy is reported by most businesses while a second authentication step is enforced by fewer, so a policy document is not evidence of an enforced control.
UK-DSIT-CSBS-20252026 · Cyber Security Breaches Survey 2025 to 2026 · external-uk-dsit-csbs-20252026
The pilot
Three accounts only: the proofing platform, one stock library, and the invoicing tool. Individual identities for all five people, one named owner per account, and the spreadsheet row is retained but marked stale so the old path is visible during review.
- partial
The guidance treats a bounded trial and observed usage as the basis for choosing, rather than a feature comparison across products.
NCSC-PASSWORD-MANAGER-BUYERS-GUIDE · Password manager buyers guide · external-ncsc-password-manager-buyers-guide
The controls
Removal must take effect before the next working day. Break-glass recovery must work with the operations lead unreachable. The studio machine must not unlock the vault from its own disk. Every exception is written down with a date.
- validated
A manager is described as a natural target because one compromise can expose all stored passwords, which is why device isolation and the master secret are verified rather than assumed.
NCSC-PASSWORD-MANAGER-BUYERS-GUIDE · Password manager buyers guide · external-ncsc-password-manager-buyers-guide
The reviewer
The operations lead owns the vault and the exception list. A second person is named for holiday cover. Neither role is an administrator, and that is disclosed rather than papered over.
- partial
Published credential guidance is written for system owners, so a team without an administrator is operating outside the stated audience of the advice it follows.
NCSC-PASSWORD-ADMIN-COLLECTION · Password administration for system owners · external-ncsc-password-administration-collection
The measurement
After one month: can anyone still reach an account through the spreadsheet path, did any recovery test succeed without the usual holder, and how many of the eleven accounts are now individually attributable? No claim of reduced breach likelihood is made.
- partial
Prevalence statistics describe what businesses reported about breaches, not the outcome of any control, so outcome claims are outside what this evidence supports.
UK-DSIT-CSBS-20252026 · Cyber Security Breaches Survey 2025 to 2026 · external-uk-dsit-csbs-20252026; D07 · 9.3 Demand-source rule · D07-S-a52b46a6e024
A failed gate
The stock library will not issue per-person logins on the studio's current plan. The account stays outside the vault, keeps its spreadsheet entry, and carries a written exception naming who may use it and when the decision is revisited.
- insufficient
Plan entitlements and per-account support were not verified against any provider documentation in this run, so the failure is recorded as an unresolved condition rather than a product verdict.
BW-ORGANIZATIONS-DOCS · Get to know your organization · external-bitwarden-organizations-docs; D08 · 11. Source Hierarchy · D08-S-e4b63d794258
The trade-off
The studio chose coverage over purity. Two accounts remain shared, so the vault does not fully answer the original question about the freelancer's access. Removing that row from the spreadsheet would have hidden the exposure instead of closing it.
- validated
The guidance states that workarounds persist when a product is not usable enough, and that persistent workarounds waste both the benefit and the cost.
NCSC-PASSWORD-MANAGER-BUYERS-GUIDE · Password manager buyers guide · external-ncsc-password-manager-buyers-guide
The conditional outcome
Proceed to the remaining accounts only after a successful removal and a successful break-glass test. Where a supplier platform offers passkeys, migrate it there first and let the vault cover only what cannot yet be migrated. If no owner can hold the exception list, stop and keep the documented manual process.
- conflicting
The newer passkey position and the older credential guidance are both in force here, so the sequence is stated conditionally rather than as a settled hierarchy.
NCSC-PASSKEYS-2026 · Leave passwords in the past - passkeys are the future · external-ncsc-passkeys-2026; NCSC-PASSWORD-ADMIN-COLLECTION · Password administration for system owners · external-ncsc-password-administration-collection
The next action
Write the eleven-account inventory today, name an owner beside each, and run one removal test before any purchase. If those three steps are impossible, the business is not ready for a vault and no product will change that.
- validated
Motion and presentation on this page exist to carry the reader from constraint to conditional verdict; the decision itself rests on the dated evidence recorded beside each statement.
D04 · 18.3 Motion eligibility test · D04-S-7c9f562cef00