In the earliest days of railways, particularly on single-line tracks, collisions were a terrifying risk. With no electronic signalling, how could railway companies stop two trains from heading toward each other on the same stretch of track?
The responsibility originally lay with the railway police, who were tasked with ensuring the safety of train movements. Drawing on their experience with policing and the authority symbolised by truncheons, they developed a system where possession of a physical object signified the right to proceed. This practice evolved into the use of a block token: a physical item that granted exclusive access to a section of track. If a train driver had the token, they were the only train allowed on that stretch. No token? No movement. It was a clear, unmistakable form of control.
Later, block tokens evolved into complex systems of electrically locked instruments, but the principle stayed the same: only one train could have the right of way at a time.
Fun fact: even today, railway signalmen are sometimes affectionately known as Bobbies — a nod to those original railway police. The nickname itself traces back to Sir Robert Peel, founder of modern policing in Britain.
As someone who is proud to serve as a director of a heritage railway, I see daily how these traditions are still respected and preserved. It is a reminder that good systems — whether on the track or in technology — are built on clear authority, trust, and well-managed control.
Fast forward to our connected digital world, and the concept of the single token of authority still underpins some of the most critical parts of cybersecurity:
Just as the railways knew they could not trust every driver to simply "check the line was clear," modern systems know they cannot just trust every user request. Authority must be granted, verified, and tightly controlled.
Whether managing trains or technology, the lesson is the same: clear, well-managed authority prevents accidents. Systems work best when it is obvious who has the right to do what — and when that authority cannot be faked or guessed.
For anyone responsible for systems, data, or even day-to-day processes in schools and organisations, the takeaway is simple:
Good security is not about trusting everyone to 'check the line is clear' — it is about having clear signals, clear authority, and clear processes. Just as it was on the railways all those years ago.
