Unmonitored Permission
F04 · 16–18
When Mr Omar held up the reading-week sheet, Ahmad was drawing small boxes in his notebook. Two classes had booked the library for the same hour, while Thursday's discussion still had no time. Ahmad, sixteen, offered to arrange the dates on the school platform. His forty-year-old teacher asked how he would know which times suited everyone. Ahmad rubbed out one of his boxes. He would collect the times from the sheet first, he said, then show the teacher his proposed timetable before confirming anything.
After Monday's last lesson, Ahmad went to the teacher's desk. Mr Omar placed an instruction sheet in front of him and pointed to the calendar heading. Ahmad could add an event or change its room after the teacher agreed. Student accounts and their information were outside his assignment. Ahmad asked to keep the sheet in his notebook. What should he do if a necessary change was unavailable to his account? He should come back to the teacher, Mr Omar replied. Finding a way to every button was not part of the job. Ahmad folded the sheet beside his pencilled boxes.
With a few minutes left before leaving, he sat at a library computer and signed into his own account. He expected the calendar among his new tools. He laid the timetable beside the keyboard and moved the pointer towards the side menu. Before reaching the calendar, he noticed a heading that had not appeared on his assignment sheet: Student Affairs.
Ahmad took his hand away from the mouse and pulled the instruction sheet from beneath his notebook. He read the line his teacher had indicated, then looked back at the menu. The line said nothing about Student Affairs. A visible heading did not tell him what lay behind it, and opening the page was not how he wanted to find out. For now, there was a difference between his written assignment and the tool on the screen. Folding and unfolding the paper did not change that.
He considered finding Mr Omar before leaving school. Then he imagined the teacher stopping his whole account while someone investigated. The timetable would return to paper. Ahmad had pictured his classmates opening a neatly arranged calendar, and liked the thought of having made it work. He did not know whether the extra heading meant he had wider access, but feared losing the permission he actually needed. He could start arranging the calendar. He could also ask first. His hand rested between the notebook and keyboard; he did neither.
Hearing students gather at the door, he closed the browser and signed out. He had not opened Student Affairs or copied information from the platform. On his way out, he took out his phone and opened the school's usual channel for contacting the teacher. He typed that an additional heading had appeared in his account menu. Before pressing Send, he added that his assignment sheet mentioned only the calendar. Mr Omar's name stayed above the message. The message stayed in the writing box.
Monday evening arrived, and the school reading schedule remained an unfinished task in Ahmad’s mind. He felt the pressure of time; every passing minute while he postponed asking increased his anxiety about the delay. Sitting before his computer, he reviewed the draft report he had prepared. He began deleting sentences containing speculations about why the extra menu appeared, stripping away unnecessary details that might distract the teacher. He wanted to focus only on what was actually visible before his eyes, distinguishing the visible menu from access he had not verified.
Ahmad paused for a moment, asking himself an internal question: Do I have the right to explore what lies behind this heading? He wasn't seeking a reward or trying to prove his courage; he was thinking about the boundaries of honesty placed in his hands. He realized that the permission granted to him was a tool for service, not an invitation to overstep. He saw a technical interface on the screen, but in his mind, he saw an ethical responsibility toward his classmates' data. It wasn't about the technical ability to click, but the sincere desire to stay within the drawn lines.
Ahmad decided not to leave the matter hanging any longer. He opened the school’s usual communication channel. He wrote a short, direct message explaining that an additional heading had appeared in his account and that he was sticking to updating the calendar as required. He did not mention any details about the other menu's content, nor did he ask for passwords or access keys. He pressed the send button and took a deep breath while waiting for the teacher's reply, leaving the final decision to the person in charge.
On Tuesday morning, Ahmad met Mr. Omar in a quiet corner of the school hallway. Omar began by saying he had read the message and asking exactly what Ahmad had seen without opening the menu. The teacher offered neither public praise nor shame, simply admitting that Ahmad was right to be concerned. Ahmad admitted he had delayed reporting the issue due to hesitation, then admitted more quietly that he had feared losing his role in arranging the timetable.
Omar wanted to verify the extent of the problem, so he used an adult-authorized test account to check the permissions granted to Ahmad’s profile. The teacher did not show Ahmad the test screen; its data had been prepared solely for checking. The results confirmed that the access was much broader than what was required for calendar editing, potentially allowing access to sensitive data. Omar explained to Ahmad that the account role did not match the written assignment and needed adjustment. He informed Ahmad that his account would be suspended pending a fix, which meant the final deadline for the timetable might be missed.
Ahmad looked at the timetable sheet in his hand. He would have to rearrange his own time, but agreed to the suspension. He had not opened any private records or copied any information during the period the glitch existed, remaining faithful to his instruction sheet. After their conversation, Mr. Omar headed to the school’s IT office to report the technical issue to the authorized technician to request a permission change and checks after the adjustment.
On Tuesday afternoon, the IT technician sat in his office reviewing system settings, adjusting Ahmad’s software role to align with his specific assignment. Meanwhile, Mr. Omar used adult-only test accounts to verify the new permissions, ensuring that access was restricted to only what was necessary. He checked what the calendar role needed and what should remain outside its limits, using data prepared solely for testing.
While this took place, Ahmad sat in a corner of the library, holding a white sheet of paper and a pen. He began manually noting down the agreed-upon event times, as his platform account remained temporarily disabled as a precaution. He felt a bit frustrated losing the time he had planned to spend finishing the club task he was looking forward to, but he realized that security preceded speed. He filled in the boxes precisely, turning the times into a clear paper schedule before he could touch a keyboard again.
When he finished, Ahmad approached Mr. Omar and handed him the paper containing only non-sensitive event times, strictly avoiding any account sharing or technical details. Later, Omar said the checks required for this assignment were finished and the calendar permission was ready. He would keep the paper until they had checked the transferred times. “Tomorrow we review the calendar alone, after your account is restored,” he said. Ahmad put his pen away; he still had club work to finish at home.
On Wednesday morning, Mr Omar told Ahmad that his account was ready with its limited calendar permission. The teacher and technician had completed the checks for this assignment using test accounts. They did not ask Ahmad to try opening student records. At the library computer, he laid Tuesday’s paper timetable beside the screen and opened only the calendar. He transferred the agreed dates, checking each room and time, then called the teacher over before confirming the schedule. The paper stayed beside the screen until their review was finished.
“I delayed asking because I was afraid of losing the job,” Ahmad said as he returned the sheet. “Then I did some of it on paper while my account was stopped.” Mr Omar pointed to the two events that had overlapped. They now had different times. Sorting everything out had taken time, he said; asking sooner would have given them more room. Ahmad did not revisit the other menu to test it himself. They did not need to announce the incident to the students. He kept the activity timetable and signed out. His club work still needed the time he had lost, but he knew how he would respond to something outside his assignment.
Now try a fictional situation. Your job is to change a club page’s event times, but a heading for members’ files appears. What were you authorized to do? What unexpected feature did you notice? Where should you stop before curiosity becomes browsing someone else’s information? Which responsible adult can you contact through a known channel? What minimal, non-sensitive information would describe your observation? Draft a short message using invented details, without members’ names, passwords, or opening the files.