Martin called me the following morning and asked me to join a secure video meeting. Marcy was there, along with a technical investigator from IT. Dana was not.
The investigator introduced himself as Noel and shared a narrow window of logs on his screen. He explained that he had matched the approval timestamp to a badge entry and a workstation session. A badge assigned to Dana had opened the conference-room door at 6:43 p.m. The approval had been submitted three minutes later from the workstation in that room.
"Can you verify that it was Dana at the computer?" I asked.
"No," Noel said. "I can verify that the badge was used. I cannot identify who was at the keyboard."
"Could it have been someone else?"
"Yes."
Marcy folded her hands. "We're not making an assumption based on a badge."
"
