Security fundamentals for collectible collections

Access & Permissions

Access and permissions are the rules that decide who may approach, enter, handle, move, inspect, photograph, document, borrow, sell or disclose information about a collectible. For private collectors, the greatest weakness is often not a defeated lock or alarm but authority that was granted informally, inherited through familiarity or never withdrawn when its purpose ended.

A family member knows where the cabinet key is kept. A cleaner enters a collection room unaccompanied. A tradesperson photographs the interior of the house. A buyer handles several objects at once. A photographer receives the owner's full database login. A courier collects an item because they know the owner and lot number. In each case the collection may be exposed without anyone technically breaking in: access was simply broader than the legitimate task.

Chapter 1

Access is broader than entry

A locked collection room controls one boundary. It does not decide who may open a cabinet, photograph an object, export the inventory, approve a sale or release a package. Those permissions should be separated because they create different opportunities and consequences.

Premises access

Entry to the home, office, storage unit or collection room. Admission to the property should not automatically imply admission to every collection space.

Container access

Authority to open a cabinet, safe, drawer, archive box, display case or sealed package. This is a separate boundary inside the premises.

Object access

Permission to touch, examine, operate, clean, open, disassemble or photograph a named item. Handling rights should be explicit rather than assumed.

Movement authority

Permission to relocate, pack, transport, lend, consign or release an object. A person allowed to inspect an item is not necessarily allowed to move it.

Information access

Visibility of photographs, inventories, serial numbers, values, storage details, provenance, insurance evidence and security-sensitive notes.

System access

Entry to collection databases, cloud folders, email, alarms, cameras, sales platforms and backup systems, including the power to export or delete data.

Transaction authority

Power to buy, sell, consign, lend, insure, approve work, accept offers or release property on the collector's behalf.

Emergency access

Defined authority to act during fire, flood, illness, incapacity, death or an extended absence without turning emergency arrangements into routine access.

These permissions should not travel together automatically. A photographer may need to handle a named object but should not see valuations. An insurer may need selected photographs and security information but not everyday alarm credentials. A family member may need emergency entry but no authority to dispose of property. A conservator may need to remove a frame yet have no reason to access unrelated cabinets.

Chapter 2

The collector's access dilemma

Collections exist to be enjoyed, studied, maintained, displayed, shared and sometimes traded. Total isolation can defeat those purposes, while unrestricted access increases theft, substitution, accidental damage, information leakage and disputed responsibility. The practical goal is controlled access.

Who is requesting access?

Why is access required?

What exactly may be accessed or done?

Under what handling, supervision or security conditions?

For how long does the permission remain valid?

How will the access, movement or handover be verified?

When any answer is vague, permission usually becomes broader than intended. “A friend is helping,” “the dealer knows me,” or “the family can sort it out” describes a relationship, not a permission. Stronger instructions describe what the person may do: enter while accompanied, photograph three named objects, add catalogue notes but not delete records, collect a sealed package after presenting a code, or act only until a stated date.

Identity is not authority

Many failures arise because a genuine identity is mistaken for permission. A person may truly work for an auction house and still lack authority to collect a particular consignment. A relative may unquestionably be who they claim to be but have no right to remove or sell collection property.

Identification

The person claims an identity: a courier, conservator, insurer, buyer, contractor, family representative or authorised collector.

The claim begins the check; it does not complete it.

Authentication

The identity is independently verified through known contact details, official identification, an appointment reference, a release code or secure account authentication.

Authentication answers: who are you?

Authorisation

The verified person receives a defined permission for a named purpose, object, place, system or period.

Authorisation answers: what may you do?

Chapter 3

Least privilege: permission should follow purpose

Least privilege means giving each person only the access required for the task. It reduces deliberate opportunity, accidental interference, unnecessary disclosure and the number of people able to make consequential mistakes. It also protects trusted people from suspicion by making clear what they never had access to.

Cleaner or domestic worker

May enter agreed ordinary rooms during a defined service period.

Usually does not need cabinet, safe, collection-record, valuation or alarm-administration access.

Photographer

May handle named objects in a prepared photography area and receive selected reference information.

Usually does not need valuations, unrelated storage access, full inventory exports or everyday alarm credentials.

Conservator or restorer

May examine and treat the named object, review relevant condition history and remove it only under agreed custody terms.

Specialist status does not create authority over unrelated items, sale decisions or the whole collection.

Courier or collection agent

May receive the prepared consignment after identity and release authority are confirmed.

Collection-room entry, unpackaged-object handling and access to other holdings are normally unnecessary.

Insurer or valuer

May see selected inventory, values, photographs, evidence and proportionate security information.

Everyday alarm codes, safe combinations and unrelated personal records should remain restricted.

Family emergency contact

May gain emergency entry, locate key records and contact named specialists or insurers.

Emergency access should not silently become routine authority to sell, dispose of or divide the collection.

Create access zones, not an all-or-nothing property

Zoning prevents an ordinary invitation into a home or workplace from becoming effective access to the entire collection. The zones do not need institutional signage; they are a way to decide which boundaries, keys and supervision rules should apply.

Zone 1 - ordinary or public space

Entrance halls, sitting rooms, reception areas and general viewing spaces. Access may be relatively open, but visible displays can still disclose the nature and scale of the collection.

Zone 2 - supervised collection space

Display rooms, libraries, studies and inspection tables. Visitors enter for an agreed purpose and remain accompanied where the risk warrants it.

Zone 3 - restricted storage

Collection stores, archive cupboards, locked cabinet areas and stockrooms. Entry is limited to named people completing defined tasks.

Zone 4 - high-security storage

Safes, strongrooms, high-value cabinets and off-site vaults. Entry may justify individual credentials, movement records or dual verification.

Zone 5 - security and administration

Alarm controls, camera systems, database administration, insurance schedules, bank and sales accounts. These systems may be physically distant yet capable of compromising the collection.

A layered arrangement might combine a locked property, a separately controlled collection room, secure cabinets for exceptional items, separately governed keys, a release procedure for removal and movement records that reveal when an object changed location. Each layer performs a different function: delay, limitation, detection, evidence or accountability.

Chapter 4

Keys, codes and credentials are portable authority

A key, combination, card or login is not merely a convenience. It is a transferable form of permission. Once copied, shared or left active, it can outlive the original task and sometimes the original relationship.

Key control

Know how many keys exist and which locks each one operates.
Record the holder, issue date, return date and exceptional conditions.
Do not keep cabinet keys in the cabinet or safe keys beside the safe.
Avoid obvious labels, universal master keys and unrecorded temporary loans.
Treat a lost or unreturned key as a security event even before loss is found.

Codes and digital credentials

Use individual credentials where the system supports them.
Limit credentials by role, time or function rather than sharing one code.
Do not reuse collection, banking, email and sales-platform passwords.
Protect the recovery email account and enable multi-factor authentication.
Remember that logs identify a credential, not necessarily the person using it.

Chapter 5

Information access can expose the collection without moving an object

A collection database, cloud folder, photograph or marketplace account may reveal enough to identify targets, values, routines, addresses and storage arrangements. Intellectual access to the collection should therefore be separated from security-sensitive access.

Public-facing collection record

•Broad description, maker, publisher or edition
•General provenance suitable for publication
•Cropped object photographs
•Non-sensitive research and scholarly notes
•Information intentionally shared with the collector community

Private security record

•Purchase price and current valuation
•Serial numbers, forensic marks and identifying damage
•Exact storage location and movement history
•Insurance schedules and confidential ownership data
•Full-resolution images, security arrangements and emergency contacts

Public sharing and private security records can coexist. A collector can publish edition information, scholarship and carefully cropped photographs without disclosing exact locations, recent valuations, high-resolution identifying images, insurance schedules or a map of the household's security arrangements.

Digital roles should reflect the same boundaries as physical access

A person allowed to contribute research should not automatically gain the power to export the whole inventory, delete evidence or create administrators. Digital permissions should be shaped around the work being performed.

View

Read selected records without changing them. Even view-only access may expose values, locations and private contacts, so field selection matters.

Contribute

Add research, descriptions or photographs without gaining access to financial fields, precise locations or user administration.

Edit

Change existing records or movement information. Editing rights should be narrower than full administration and should preserve an audit trail where possible.

Export

Download a copy of records, images or the full inventory. Export is powerful because copied data can persist after account access is revoked.

Delete

Remove records, evidence or audit history. This should be restricted, recoverable where possible and protected from routine mistakes.

Administer

Create users, alter permissions, change recovery routes and security settings, manage integrations and control backups. Administrator access should be rare.

Photography and social media create indirect access

Permission to inspect an object is not automatically permission to photograph, retain, publish or redistribute images. Photographs can document the collection well, but they can also reveal serial numbers, room layout, adjacent valuables, addresses, security markings, reflections and location metadata.

Define photographic permission

May the person take reference photographs?
May they photograph the room or only the prepared object?
May images be retained, downloaded or stored in the cloud?
May they publish, resell or share them with third parties?
May ownership, location or value be identified?

Reduce unplanned disclosure

Crop backgrounds, labels, addresses and unrelated objects.
Check reflections in glass, metal and glossy packaging.
Avoid real-time posting of holidays, fairs, deliveries and empty-property periods.
Separate public collector identity from private household information where useful.
Check whether image metadata or shared folders disclose more than intended.

Continued permission creates uncertainty, weakens accountability and may conflict with privacy or insurance expectations even where nobody is suspected of wrongdoing.

Better control

Treat the change as routine offboarding: retrieve or replace keys, change credentials, close sessions, revoke links and review significant movements.

Supervision is a real control

Supervision is not simply hospitality. It means knowing who is present, understanding the agreed task, controlling restricted doors and keys, observing object movement and confirming that the area is secure when the person leaves.

Effective supervision

The task, objects and permitted area are agreed in advance.
The responsible person can observe relevant activity.
Restricted doors, keys, bags and packaging remain controlled.
Unapproved photography, wandering or object movement can be noticed.
Departure, return of credentials and closure of the area are confirmed.

Nominal supervision

The collector leaves the room for long periods.
Several visitors disperse through the property.
The work area cannot be seen or small objects are obscured by packing materials.
A professional title is treated as a reason to abandon oversight.
Credentials remain active and the area is not checked afterwards.

Chapter 7

Movement, packing and custody require separate authority

An object can be legitimately viewed but illegitimately moved. Packing and transport create temporary environments in which many items are exposed, labels and components can be mixed, doors remain open and several people may believe they are following valid instructions.

1.Confirm the person, authority, destination and agreed custody terms.
2.Identify the exact object against the collection record.
3.Photograph condition and distinguishing details before packing.
4.Inventory detachable components, inserts, accessories and accompanying documents.
5.Pack in a controlled area with only the necessary object and materials present.
6.Seal or tamper-mark the package where proportionate.
7.Label it accurately without unnecessarily advertising valuable contents.
8.Record the handover time, recipient, vehicle or consignment reference.
9.Obtain proof of custody and understand when insurance responsibility changes.
10.Update the object's location and expected return or delivery status.

Loans grant temporary custody, not unrestricted authority

A borrower may possess the object without acquiring the right to move, publish, clean, repair, open, sub-loan or permit third-party access. The loan terms should define use and return rather than relying on assumptions.

Define before release

Named borrower, location and permitted handlers
Display, storage, movement and photography conditions
Insurance responsibility and security standards
Treatment, cleaning, mounting and opening restrictions
Start date, end date, reporting duties and emergency contacts

Preserve identity and return evidence

Object-level photographs and distinguishing marks
Condition and component inventory at transfer
Itemised receipt and custody acknowledgement
Expected return method and authorised recipient
Updated location record when the object leaves and returns

Chapter 8

Higher-risk actions may need dual control or separation of duties

For most private collectors, two-person control is unnecessary for routine access. It becomes useful when one mistake, unauthorised decision or disputed action could have exceptional consequences.

Dual control

Two authorised people genuinely verify an exceptional action rather than one person acting and another merely signing later.

Opening exceptional storage
Releasing a major consignment
Changing safe combinations or emergency credentials
Approving disposal of high-value or disputed material
Moving objects after death or incapacity

Separation of duties

A sensitive process is divided so that one person cannot prepare, approve, complete and conceal the same action.

One person prepares a sale; another approves price or release.
An assistant adds records; only the owner deletes them.
An accountant sees totals but not storage locations.
An executor locates assets but cannot buy them privately without scrutiny.
Independent alerts or statements compensate where the collector works alone.

Specialist threshold

When informal permission is no longer enough

More formal identity checks, condition evidence, custody terms and named release authority are warranted when several of the following are present:

✓The object is rare, unique, unusually valuable or difficult to replace.
✓It contains many detachable, interchangeable or easily substituted components.
✓Inspection or treatment requires opening, disassembly or irreversible intervention.
✓The object will leave the owner's possession or remain elsewhere for a significant period.
✓Authenticity, condition, ownership or component substitution could later be disputed.
✓Insurance responsibility or the point at which custody transfers is not self-evident.

The response may include an itemised receipt, condition report, component photographs, treatment authority, insurance confirmation, subcontracting rules, return date and explicit identification of the person allowed to receive the object back.

Chapter 9

Permission creep, temporary access and revocation

Access often becomes excessive by accumulation rather than by one dramatic decision. A friend photographs one item, receives a key for convenience, begins cataloguing, obtains database access, gains administrator rights to solve a problem and keeps every permission after the project ends.

Step 1

Define the original task

Step 2

Choose the lowest suitable permission

Step 3

Set an expiry or review date

Step 4

Reassess when the task changes

Step 5

Revoke and verify closure

Temporary access should have an explicit end. Retrieve keys and passes, disable codes and accounts, remove shared-folder access, revoke download links, confirm return or deletion of confidential files where possible, update the authorised person list and check that account recovery or forwarding routes no longer remain.

Revocation is a security event, not administration for later

Access should be reviewed promptly after departures, relationship changes, lost devices, compromised passwords, completed consignments, changes of adviser, moves to a new property, death, incapacity or any material dispute.

✓Retrieve keys, cards, passes and physical tokens.
✓Change codes, combinations and shared credentials.
✓Disable accounts and sign out old devices or sessions.
✓Revoke shared links, integrations and recovery access.
✓Remove alarm, camera, storage and courier contacts.
✓Update emergency and authorised-person records.
✓Preserve and inspect relevant logs before they expire.
✓Conduct a targeted inventory where concern exists.

Chapter 10

Emergency and estate access must be usable without becoming a master key

Security can fail through excessive restriction as well as excessive openness. If only the collector knows every key, code, contact and record location, illness or death may leave family, executors and emergency responders unable to protect or even identify the collection.

Emergency access should provide

A named person and a clear trigger for use
Insurer, storage, solicitor and specialist contacts
A high-level location map and priority actions
Warnings about fragile, hazardous or borrowed objects
Explicit limits on movement, sale, disposal and disclosure

Avoid creating one catastrophic document

Do not place every credential, value and security detail in one obvious envelope.
Separate access instructions from master account passwords and financial records.
Use sealed, securely held or limited-access arrangements.
Define how credentials are changed after emergency use.
Review the arrangement when people, property or systems change.

Estate administration can suddenly involve executors, beneficiaries, solicitors, valuers, auction houses, removers, landlords and house-clearance firms. Without clear authority, objects can be divided informally, removed before valuation, separated from documentation or sold by someone who lacks title. Estate planning should identify ownership, authorised decision-makers, items belonging to others, loans and consignments, inventory location, appropriate specialists and the method by which entry and removal are documented.

Chapter 11

Recognise incidents before they become confirmed losses

An access incident includes more than theft. A lost key, disclosed code, unknown person in a restricted room, mistaken cloud share, unexplained export, unrecorded object movement or package released to the wrong courier can all expose the collection.

1.Protect people and avoid confrontation where it would be unsafe.
2.Secure the affected area, account, credential or process.
3.Preserve messages, logs, camera footage and transaction evidence.
4.Identify the full access that was possible, not only what is visibly missing.
5.Inventory affected objects and verify location, components and condition.
6.Change credentials, locks or recovery routes as required.
7.Notify the relevant insurer, platform, storage provider or police where appropriate.
8.Document times, decisions, actions and unresolved uncertainties.
9.Review the permission failure that made the incident possible.

Read evidence carefully

Access evidence rarely proves one explanation by itself. The collector's task is to distinguish the observed fact from possible meanings and then act on the exposure that exists while the cause remains uncertain.

Evidence

A cabinet is found unlocked.

What it may mean

It may reflect human error, a failed lock, unauthorised access or deliberate preparation for later removal. The evidence does not identify the cause by itself.

Collector risk

Objects may have been handled, photographed, substituted or moved even when nothing is immediately known to be missing.

Evidence

A former assistant still has database access.

What it may mean

Offboarding may simply have been incomplete, but the permission remains real regardless of intent.

Collector risk

Values, locations and personal data remain exposed, and later activity may be difficult to attribute confidently.

Evidence

A specialist requests the entire inventory.

What it may mean

They may want context or administrative convenience rather than intending misuse.

Collector risk

The collector reveals unrelated assets, collection scale, values and storage intelligence that are unnecessary for the task.

Evidence

Relatives remove items independently after a death.

What it may mean

They may understand the objects as personal keepsakes and may not recognise the need for estate authority or documentation.

Collector risk

Provenance, valuation, ownership evidence and equitable estate distribution can be damaged before formal administration begins.

Evidence

Every alarm entry uses the same shared code.

What it may mean

The system records a credential rather than an individual and cannot reliably show who entered.

Collector risk

One person's access cannot be withdrawn selectively, and activity records provide weak accountability after an incident.

Chapter 12

Build a proportionate access model

The purpose of a permission model is not to turn a private collection into an institution. It is to stop every trusted person from becoming a de facto co-administrator of the collection.

Level A

Owner control

Full physical, digital and transaction authority, with protected administrator and recovery access.

Level B

Trusted operational access

A named person performs recurring tasks under documented limits without acquiring unrestricted ownership or disposal authority.

Level C

Specialist access

Time-limited access to named objects or records for valuation, conservation, photography, research or sale preparation.

Level D

Accompanied visitor access

Entry or inspection while supervised, with no independent handling, movement or system authority.

Level E

Public information access

Only information deliberately prepared for publication, without sensitive values, locations, security or personal data.

Adapt the model to collection value, rarity, site type, number of helpers, frequency of movement, owner vulnerability, public visibility and insurance requirements. The correct arrangement may be simple, but it should be deliberate.

Action hierarchy

Begin with exposed authority and weak recovery routes. Add structure next, then adopt higher-security measures only where the consequence and collection profile justify them.

Priority 1

Immediate priorities

Close obvious gaps that create unbounded or unexplained access today.

•Identify everyone who currently holds keys, codes, accounts, shared links or release authority.
•Remove permissions that no longer have a current purpose.
•Separate public collection information from private security, valuation and location records.
•Protect collection and recovery email accounts with unique passwords and multi-factor authentication.
•Define who may move, hand over, consign or sell objects.
•Create a workable emergency-access arrangement.

Priority 2

Near-term improvements

Turn informal arrangements into repeatable controls that support normal collecting activity.

•Create individual digital accounts rather than sharing the owner's login.
•Introduce a simple key, code and credential register.
•Set visitor, contractor, specialist and courier rules.
•Record important object movements and custody transfers.
•Divide the collection site into practical access zones.
•Review cloud links, old devices, administrator accounts and recovery routes.

Priority 3

Higher-security measures

Use these where rarity, value, complexity, public visibility or insurance requirements justify stronger evidence and control.

•Use individual electronic credentials with alerts and time restrictions.
•Require dual verification for exceptional releases, disposals or storage access.
•Restrict administrator, export and deletion permissions.
•Segment alarm, camera and remote-support access.
•Conduct periodic independent inventories or targeted audits.
•Use formal confidentiality, loan, custody and estate arrangements where proportionate.

Documentation that supports control

Records should prove authority, movement and closure without becoming a complete guide to defeating the collection's security. Keep the system usable, current and proportionate.

Record	Purpose and caution
Authorised-person list	Shows who currently holds recurring physical, digital, emergency or transaction authority. Review after relationship, role, insurer, storage or household changes.
Key and credential register	Records what each key, code, card or account opens and who holds it. Store securely; do not create a single convenient map of every defence.
Digital users and roles	Shows who can view, edit, export, delete or administer collection data. Include linked devices, recovery routes and dormant accounts.
Visitor and contractor record	Captures significant attendance, purpose, areas entered, credentials issued and unusual events. Use proportionately; routine domestic life does not require institutional bureaucracy.
Object movement and custody log	Shows what moved, who authorised it, where it went, condition at transfer and expected return. Update promptly, because an outdated movement record can conceal a genuine absence.
Loan, consignment and specialist papers	Defines handling, movement, treatment, insurance, publication, subcontracting and return authority. Photographs and an itemised condition record are especially important for complex objects.
Emergency and estate instructions	Provides enough information for named people to act during incapacity or death. Separate operational guidance from master credentials and full financial records.
Incident and revocation record	Documents lost keys, disclosed codes, mistaken sharing, unexplained access and the corrective action taken. Preserve logs and evidence before resetting or deleting systems where an investigation may follow.

Myth versus reality

Access failures often begin with assumptions that feel socially comfortable but collapse when an object, account or authority is disputed.

Myth

Only strangers are a security risk.

Reality

Most meaningful access is held by known, trusted or professionally connected people. Controls govern opportunity and consequence; they are not moral judgments about character.

Myth

A locked room solves access control.

Reality

Keys, codes, cabinet access, digital records, movement authority, sale authority and emergency procedures are separate permission boundaries.

Myth

Anyone who can view a record may as well edit it.

Reality

Viewing, changing, exporting, deleting and administering create materially different risks and should be separated wherever the system allows.

Myth

Family automatically knows what it may do.

Reality

Domestic familiarity often creates ambiguous authority, especially during illness, separation, death or estate administration.

Myth

A professional should not be supervised.

Reality

Proportionate supervision protects both parties, supports correct handling and creates stronger evidence of custody and condition.

Myth

Changing a password removes access.

Reality

Downloaded files, exports, active sessions, recovery accounts, forwarded links, copied keys and linked devices may survive a password change.

Questions for a collector's access review

Any question that cannot be answered confidently indicates a permission gap, an evidence gap or an emergency-planning gap.

✓Who can physically enter the collection area today?
✓Who can open every cabinet, safe or storage unit?
✓Are all keys, cards, codes and linked devices accounted for?
✓Does each digital user have an individual account and appropriate role?
✓Who can see values, precise locations and private ownership information?
✓Who can export, delete or administer the inventory?
✓Who can release an object to a buyer, courier, dealer or auction house?
✓What changes when a contractor or domestic worker attends?
✓How is access removed when a helper, relationship or service ends?
✓What happens if the owner is incapacitated or dies?
✓Can one object be accessed without exposing the wider collection?
✓Would an unauthorised movement or data export be noticed?

Core collector doctrine

Twelve rules for access and permissions

1.No access without a legitimate purpose.
2.Verify identity independently where the consequence warrants it.
3.Grant only the minimum permission needed for the task.
4.Separate entry, handling, movement, information and transaction authority.
5.Prefer individual credentials over shared keys, codes and accounts.
6.Use proportionate supervision rather than relying on social status or reputation.
7.Record important movements, handovers and custody transfers.
8.Give temporary access an explicit end date.
9.Remove access promptly when circumstances change.
10.Maintain secure but usable emergency and estate access.
11.Review permissions after incidents, projects, sales, loans and major life changes.
12.Design controls around real human behaviour, not hardware alone.

The central conclusion

Access is not a binary choice between trusted and untrusted. It is a collection of specific permissions attached to people, purposes, places, objects, information, systems and time.

A well-secured collection does more than keep outsiders away. It allows every legitimate person to do what they need to do - and no more than they need to do - without acquiring unrecorded authority over the collection.

Continue learning

Knowing What Needs Protection

Identify the objects, records, systems, people and information that require proportionate protection.

→

Back to Security Fundamentals

Return to the full security-fundamentals reading sequence and topic list.

→

Layered Protection

Build overlapping physical, procedural, informational and evidential safeguards so one failure does not expose the collection.

→