FIELD RECORD: The terminal welcomed the next visitor by the previous visitor’s name.
This is original systems fiction set in Clandestinia, not a report about a real organization. The exercise below is for synthetic records in an authorized test environment.
The Screen Returned to Blue
After The Promise in the Estimate, the woman on Bench Nine finally received a confirmed instruction. Before following the porter, she used the concourse terminal to acknowledge it.
The machine printed a receipt. She pressed Finish. Her case disappeared, and a blue welcome screen replaced it. She left the chair straight for the next person.
A traveler sat down and selected Check a request. The machine showed the woman’s name.
He turned away without opening the record and called the attendant. Mara asked the attendant to take that terminal out of public use while the incident was assessed. Nobody needed to read another person’s documents to establish that the handover was wrong.
Finish Had Finished the Wrong Thing
The interface team had implemented Finish as a return to the start screen. The authentication session belonged to a different component, whose timer had not expired. The next visitor’s request reached that component carrying the previous visitor’s identity.
The terminal had changed what it displayed without changing whom it represented.
A supervisor suggested clearing the visible name and reopening the chair. Mara asked which identity the next action would use. Removing the greeting would conceal the warning, not establish a new boundary.
The team also found a draft form in the interface’s local state. Ending the authenticated session was necessary, but it would not by itself explain what happened to that draft or the printed receipt resting beside the screen.
Keep the Work, End the Access
The woman’s acknowledgment had already been saved to her case. Ending her terminal session did not need to undo it. The operator separated three jobs: preserve the accepted transaction, end the terminal’s authority to act as her, and remove residual personal information from the shared interface.
The team tested the revised handover with invented users and marked documents. They checked the ordinary next action, browser navigation, a second open tab and an interrupted finish sequence. A clean welcome screen was one observation among several, not the completion criterion.
The attendant recorded what had been observed and followed the station’s privacy-response procedure. The visible name established a possible disclosure. It did not establish which other information had been accessed, and the team did not fill that gap with reassuring guesses.
When the chair reopened, Finish had a narrower, tested meaning. The woman’s saved acknowledgment remained in her account. The next traveler was asked to establish his own identity.
Field assessment: returning a device to its starting screen is not the same as returning it to a state safe for another person.
Review Exercise: Two Visitors, One Device
Use a staging system or paper model with two fictional users, A and B. Give A an unmistakably synthetic case label and a draft containing no real personal information. Do not investigate this scenario by opening another person’s account on a live public terminal.
Establish the contract. Specify which work is saved, what Finish should end, and which device-local material should be cleared. Distinguish an unsaved draft from an accepted submission. A privacy fix should not silently delete a completed transaction.
Test the next action. Have A finish, then have B begin through the normal interface. Verify both the displayed identity and the authorization applied to subsequent actions. A hidden name is not proof that A’s authority has ended.
Test interrupted handovers. Model a second tab, navigation back to an earlier screen, an idle timeout and a failed completion request. Check how the device handles uncertainty and whether it prevents a new visitor from inheriting the previous session. Define when an attendant must intervene.
Inspect the remaining surfaces. Review drafts, downloads and printed output under the system’s actual design. Browser-session controls cannot retrieve paper from a tray. Assign responsibility for each relevant surface rather than calling every residual risk a login problem.
Record expected and observed outcomes with synthetic evidence. This exercise is not a complete kiosk-security specification or a substitute for an authorized privacy assessment. For the broader distinction between a changed interface and a verified outcome, continue to the Digital Systems Accountability guide.