She turns back to me. “How much?”
I’ve already calculated it, of course. Three separate ways.
I give her the figure.
“That’s not leakage,” she says. “That’s strategy.”
I pull a legal pad toward us and start writing the dates in sequence. Access, invoice, transfer behavior, supporting document adjustments.
Annie immediately begins matching them to operational events. Her handwriting is faster than mine, less rigid but still controlled.
For fifteen minutes, neither of us says anything unnecessary.
We isolate the first cluster around livestock shipments. The second around contract renewals. The third around overtime approvals during storm recovery.
Each time, the same behavior repeats: legitimate operational pressure creates noise. Within that noise, small consulting-related amounts move through approved channels; after hours, files connected to those movements are accessed and occasionally refined.
Annie circles the latest cluster and goes still. “Wait.” I follow her line of sight. “Look at the approval path.”
She’s right, and I hate that she’s right before I am.
The transactions aren’t only hidden inside busy periods.
They’re hidden inside the busiest parts of specific approval structures. The moments when work is split between departments.
Ops. Accounts. Vendor confirmation. Scheduling adjustments. Legal attachments on some of the larger service bundles.
Too many hands touching the process for any single irregularity to seem singular.
“Distributed visibility,” I say.
She nods. “Nobody sees the whole thing unless they’re looking across departments.”
“Which most people don’t.”
“And whoever’s doing it knows that.”
I write the words down even though I won’t need to.
I’m not recording the thought. I’m controlling the pace of the realization, because the realization is arriving whether I want it to or not.
I pull the user access hierarchy from memory rather than screen. “To do this consistently, they’d need more than surface familiarity.”
Annie’s already there. “They’d need to know who checks what. When. And how deeply. They’d need to understand alert thresholds. They’d need to know where you automated and where you didn’t.”
“Yes.”
“Cody…”
“This isn’t external,” I say.
I stand and cross to the filing cabinet, not because I need anything in it, but because movement helps structure thought when thought threatens to become reaction. My hand braces against the metal edge.
Behind me, the office is peaceful enough that I can hear the subtle shift of paper as Annie sets her pen down.
I turn back.
“The unauthorized credentials,” I say. “The timing. The specific file paths. The adjustments to metadata without triggering broader corruption. The choice of operational windows. The restraint in amount and frequency.”