Chapter 16
CHAPTER SIXTEEN
Cody
I wait until after dinner.
During the day, the office is too exposed. Staff moving in and out. Phones. Deliveries. Sherry appearing in doorways with questions that should’ve been emails if this place functioned as a proper business instead of a legacy operation held together by routine and reputation.
At night, the ranch narrows.
Noise reduces, movement becomes trackable, interruptions become identifiable.
Which means if I’m going to let Annie Wright see this part of me, I need it contained.
I find her where I expected to: at her desk, still working.
The house lights have gone softer with the hour, the main office illuminated mostly by the desk lamp at her elbow and the cool glow of the monitor in front of her.
Papers are spread across the surface in a pattern that still irritates and impresses me. Her camera sits beside the keyboard.
One hand rests on a stack of vendor files while the other moves across a calculator with quick, efficient taps.
She doesn’t notice me at first.
That’s unusual.
I stand in the doorway a second longer, watching the line of concentration in her face, the slight furrow between her brows, the thumb of her left hand tapping once against the camera body as she thinks.
Then I speak. “Come with me.”
Her head lifts, attention locking on target. “What happened?”
“I need you to come to my office. Now.”
When we reach my office, I open the door, step aside just enough to let her in, then close it firmly behind us.
She turns slowly, taking in the room as if she hasn’t already been in here before. It’s not personal curiosity. It’s situational awareness.
Exit points. Desk. Computer. Filing cabinets. Distance between us.
“What’s this?” she asks.
I move to the desk and wake the monitor. “Verification.”
Her eyes narrow. “That sounds ominous.”
“It isn’t.”
That’s not entirely true, but I’m not interested in dramatics. The situation is what it is regardless of tone.
I pull up the access logs I isolated a while back and angle the screen toward her without surrendering the chair.
She steps in beside me, close enough that I catch the scent of espresso and something softer underneath it. Vanilla, maybe. Rain.
I ignore that.
Mostly.
“What am I looking at?” she asks.
I point to the highlighted line. “Vendor file access. One of the accounts you flagged. At a weird time.”
She leans in. “Time?”
“Two-thirteen in the morning.”
Her gaze flicks across the rest of the line, then lower, then back again. Processing.
“And the credential used was mine?”
“Yes.”
“I wasn’t accessing anything at that time.”
“No,” I agree. “You shouldn’t be able to access this data either. Not without authentication.”
She doesn’t look at me.
That, more than anything, is what keeps me calm. Guilty people look for the reaction before they build their own. Innocent people go to the data first.
She goes to the data.
She shifts closer to the desk, one hand bracing against the edge as she reads. “So the file was opened under my credentials without the system recording how the access happened?”
“Correct.”
“That shouldn’t be possible.”
“No,” I say evenly. “It shouldn’t.”
Her jaw tightens with irritation. “Show me the surrounding entries.”
I already have them pulled up. I click open the adjacent records and step half an inch to the side, giving her visual priority without ceding control of the machine.
She tracks the screen quickly. Timestamp clusters, file paths, user credentials. System recognition markers.
Her eyes move in patterns I recognize immediately, because they mirror mine. Not reading linearly, but mapping. Comparing lateral behavior across entries rather than treating each record as isolated.
She points. “This one.”
I enlarge it.
“Normal access?” she asks.
“Yes.”
She meets my eyes then. “Because it has the authentication handshake?”
“Yes.”
“And this one…” she taps the unauthorized entry with one short nail, “doesn’t.”
“No.”
“Okay.” She exhales. “Then whoever did this either bypassed the login sequence or injected the access record after the fact.”
I glance at her. “That was also my conclusion.”
“Also?” she mutters. “That’s so reassuring.”
I let that pass.
She straightens. “How many times has this happened?”
I bring up the second screen so she can see the five times, across different dates at various times.
Vendor files. Invoice clusters. Consulting charges. Supporting documents. Entry logs. All touched after hours. All under valid user names. All without proper authentication capture.
I watch her face as she realizes the scale of it. “Who else knows?”
“No one.”
“Not Silas?”
“No.”
She gasps a little. “Why?”
Because I don’t escalate until certainty exists. Because Silas’s solution set tends toward force, and force is inefficient when the problem is still structural.
Because if this is what I think it is, premature confrontation will collapse the trail before I’ve finished tracing it.
I don’t say any of that.
“Because I wanted verification first,” I say.
Her eyes flick to mine then. “And you thought I might be involved?”
I don’t insult her by denying it. “I considered every available explanation.”
She holds my gaze for one beat longer. Then nods once. “Good.”
That one word ignites a small, unwelcome shift somewhere under my ribs. Respect, maybe. Or the more cutting thing underneath it.
The thing I keep trying not to name when it comes to her because names create structure and structure creates consequences.
“Sit,” I say.
She arches a brow. “That sounded suspiciously like an order.”
But she takes the chair beside mine, pulling it in with the kind of practical movement that wastes no time. I sit again immediately after, and the room narrows to monitor light, paper, and proximity.
I open the invoice batches she flagged weeks ago and layer them beside the access logs. “Walk me through the vendor behavior again.”
She doesn’t bother pretending she needs a second to reorient. “Amounts stay below alert thresholds. Timing aligns with high-volume operational periods, which creates visual noise. Entries don’t repeat identically, but they behave identically.”
“Meaning?”
“They’re designed to survive surface review.”
I click through the invoices. “And the company?”
“Exists enough to pass. Not enough to justify frequency. I think, anyway.”
“Continue.”
She reaches past me for a pen, pauses when she realizes it’s mine, then takes it anyway. I don’t comment.
She shouldn’t be able to make that look as natural as she does.
“Look here,” she says, drawing a line across a set of charges on the printed invoice summary. “Different amounts. Different dates. But all of them hit during periods when Ironwood was already compensating for legitimate expense spikes.”
I track the entries. Shipment week, overtime approvals, feed increase, emergency equipment repair.
She’s right.
Annoyingly, predictably right.
“They’re hiding movement inside legitimate volume,” I say.
“Yes. Which means if someone was monitoring totals, nothing looks dramatic. No single charge is large enough to trigger alarm. The bleed only appears when you examine behavior over time.”
“Not entries. Context.”
“Exactly.”
This is what she does. She sees structure beyond surface. She doesn’t just read data; she interprets how data behaves under pressure.
She flips to another page, then another, organizing them in fast, logical layers across the desk. “Cross-reference these against the access dates.”
I do.
The overlap is immediate.
Unauthorized file opens within twenty-four hours of payment approvals. Sometimes before. Sometimes after. Never random.
Always adjacent.
“Not curiosity,” she says.
“No.”
“Maintenance.”
“Yes.”
Shit. “They’re checking the trail.”
Or modifying it.
I don’t say that immediately because once it’s said, the room changes.
I open the deeper metadata extract and bring up file revision behavior. We both go still. Not all the records were merely accessed. Two were altered.
One had attached document labels adjusted. One had internal notation removed and reentered in a different field to preserve visible continuity while breaking search consistency.
The precision of it makes my stomach turn, because that isn’t guesswork. That’s someone who understands exactly where the system can be manipulated without setting it off.
I hear Annie inhale. “Okay, that’s bad.”
“That’s one description.”
She cocks a brow. “You have a more precise one?”
“Yes.” She waits. “This person knows how my system works.”
I lean back, adjusting my watch with more force than necessary.
“These changes avoid common alerts. They don’t disturb balances enough to flag. They preserve visual continuity for casual review. They redirect attention without severing the chain entirely.”
“Because if the chain vanished, someone would notice?”
“Yes.” She sits back too, widening her angle on the problem. “So we’re looking at someone careful and experienced. Not greedy in a messy way.”
“Right.”
“Methodical enough to understand how to take money without making the loss look like loss.”
I look at her profile as she says it.
The precision of her thought process should be purely satisfying. In professional terms, it is. There’s very little I value more than competence under pressure.
The fact that watching her do this produces a second, less professional response is inconvenient.
“The money bleeds out in increments,” I say. “Small enough individually to avoid notice. Consistent enough collectively to be intentional.”
She turns back to me. “How much?”
I’ve already calculated it, of course. Three separate ways.
I give her the figure.
“That’s not leakage,” she says. “That’s strategy.”
I pull a legal pad toward us and start writing the dates in sequence. Access, invoice, transfer behavior, supporting document adjustments.
Annie immediately begins matching them to operational events. Her handwriting is faster than mine, less rigid but still controlled.
For fifteen minutes, neither of us says anything unnecessary.
We isolate the first cluster around livestock shipments. The second around contract renewals. The third around overtime approvals during storm recovery.
Each time, the same behavior repeats: legitimate operational pressure creates noise. Within that noise, small consulting-related amounts move through approved channels; after hours, files connected to those movements are accessed and occasionally refined.
Annie circles the latest cluster and goes still. “Wait.” I follow her line of sight. “Look at the approval path.”
She’s right, and I hate that she’s right before I am.
The transactions aren’t only hidden inside busy periods.
They’re hidden inside the busiest parts of specific approval structures. The moments when work is split between departments.
Ops. Accounts. Vendor confirmation. Scheduling adjustments. Legal attachments on some of the larger service bundles.
Too many hands touching the process for any single irregularity to seem singular.
“Distributed visibility,” I say.
She nods. “Nobody sees the whole thing unless they’re looking across departments.”
“Which most people don’t.”
“And whoever’s doing it knows that.”
I write the words down even though I won’t need to.
I’m not recording the thought. I’m controlling the pace of the realization, because the realization is arriving whether I want it to or not.
I pull the user access hierarchy from memory rather than screen. “To do this consistently, they’d need more than surface familiarity.”
Annie’s already there. “They’d need to know who checks what. When. And how deeply. They’d need to understand alert thresholds. They’d need to know where you automated and where you didn’t.”
“Yes.”
“Cody…”
“This isn’t external,” I say.
I stand and cross to the filing cabinet, not because I need anything in it, but because movement helps structure thought when thought threatens to become reaction. My hand braces against the metal edge.
Behind me, the office is peaceful enough that I can hear the subtle shift of paper as Annie sets her pen down.
I turn back.
“The unauthorized credentials,” I say. “The timing. The specific file paths. The adjustments to metadata without triggering broader corruption. The choice of operational windows. The restraint in amount and frequency.”
I stop, because I don’t want to say it, because once I do, there’s no taking it back.
Annie’s eyes stay on mine.
“Whoever is doing this,” I say, “knows Ironwood’s system. Which means… it’s someone close.”
I built this system to protect the ranch from inefficiency, from loss, from sloppiness, from the kind of preventable failure that comes when people mistake discipline for habit.
And someone has been inside it, using that discipline against us.
“This stays between us for now,” I say.
She studies me. “You’re sure?”
“No,” I say honestly. “I’m not sure of anything except the pattern. But I think it’s for the best.”