<a id="ch-14"></a>

## Chapter 14 — A new starter does not inherit a key

<!-- open-cyber-academy:lesson-figures:start ch-14 -->
### Lesson map

Lesson 14 published. Map, example, EX068.

```mermaid
flowchart TD
  K["Two nurses received security keys"] --> W["They had declined work apps on personal phones"]
  W --> R["A new receptionist asks for an app on their own phone"]
  R --> M{"Has Dr. Moss written the method for this person?"}
  M -->|No| H["Do not copy the nurses' keys and do not install the app"]
  M -->|Yes| G["Use the method that line names"]
```

The keys answer two people's refusal. They are not a template.

### Logical drawing

```text
second factor, clinic-wide
    Dr. Moss and office team first
    two nurses: keys, because they declined personal-phone apps
new receptionist, method not yet written
    |
    +-- the nurses' reason is not this person's reason
    +-- a third key is a new cost, not an automatic issue
    +-- an app installed early is a setting change without agreement
```
<!-- open-cyber-academy:lesson-figures:end ch-14 -->

### Learning outcomes

After this chapter, you should be able to:

1. Keep the two security keys attached to the two nurses who declined phone apps.
2. Refuse both an automatic third key and an unapproved app for a new starter.
3. Require Dr. Moss's written choice of method before that person uses the account.

### 14.1 A reason does not travel with the hardware

The clinic bought two security keys because two nurses did not want work applications on their own phones. That sentence has subjects: those nurses, that refusal, those keys. A new receptionist starting Monday asks to approve sign-ins with an app on a personal phone. The nurses' refusal does not answer the request, and it also does not force the clinic to buy a third key. Dr. Moss writes which method this person will use. Until that line exists, Sofia neither issues hardware nor installs an app. Installing the app first would change a setting before the written agreement the month's ground rule requires.

The account itself still follows Chapter 2: a personal account, not the old shared reception login. This lesson does not pick the method.

### 14.2 Worked example

| Proposal | Whose decision it copies | Decision |
|---|---|---|
| "Give them a key, like the nurses." | A refusal this person has not made | Wait. A third key needs its own agreement |
| "Install the app today so Monday is easy." | No written method | Refuse the early install |
| "Dr. Moss wrote 'app on personal phone' for this receptionist." | A line about this person | Follow that line |
| "Skip the second factor for the first week." | The shared-login exception already refused for the locum | Refuse |

> **Synthetic case.** The new receptionist is not given a personal name. No method is chosen here.

### Errors and limits

Writing the method does not disable anyone else's factor, and it does not prove the person has completed the ten-minute catch-up topics. Those topics are a separate list.

### Apply

- **EX068 — Which method is allowed on Monday?** A new receptionist wants an app on a personal phone. The only keys in the log are the two bought for the nurses. Dr. Moss has not written a method for the new person. What do you refuse to copy, and what do you refuse to install? *Rubric:* 3 = do not issue a key merely because the nurses have keys; do not install the app before Dr. Moss writes this person's method; the account still must not be the shared reception login;; 2 = block both the copied key and the early app;; 1 = one block;; 0 = none.

<!-- open-cyber-academy:chapter-navigation:start ch-14 -->
### Continue studying — lesson 14 (chapter 14 of 20)

[← Chapter 13](#ch-13) · [Course chapter index](../SUBJECTS.md) · [Chapter 15 →](#ch-15)

Continue to the next authored lesson.
<!-- open-cyber-academy:chapter-navigation:end -->

## Worked answers

<a id="answer-ex068"></a>
**EX068.** Do not issue a third key just because two nurses have keys. Do not install an app before Dr. Moss writes the method for this receptionist. The account must not be the shared reception login.
