"Williams has no access at all now, correct?" he asked.
"Correct, Sheriff. Her account and devices were disabled."
"Then anything after that has a separate record," Owen said quietly.
"Yes," the administrator answered.
Cole looked at him. "Why does that matter to you?"
Owen considered the question. "It may not. I want to understand the cutoff before I sign anything else about what happened."
Cole told the administrator to send the records and left. The administrator waited until he had gone before looking at Owen. "Are you expecting someone to change something?" she asked.
"I'm trying to understand what can be changed and what can't," Owen replied. "That's different."
By the following afternoon, the inspector's analysts had the raw access report. The first line looked reassuringly familiar to anyone who had read Cole's referral: an extraction associated with the username M. Williams. The second set of fields changed the significance of the first. The command had not originated from Maya's county laptop, her assigned workstation, or a verified session tied to either device.
Instead, the recorded source was the central administrative gateway. The analysts requested Maya's privilege history and confirmed that she had never been granted the administrative authority ordinarily required to initiate a command from that environment. They checked a second record to rule out a simple permissions reporting error, then asked county IT to authenticate the administrative delegation history. The gap between the username and the source was no longer a minor formatting question; it was an unanswered question about who had issued the command.
The state inspector's office did not issue a declaration of innocence. A username might be used through a delegated process, an account might be compromised, and a legitimate user could theoretically participate in an action without directly logging into the gateway. The investigators were careful not to convert a missing explanation into proof of a particular alternative. But the raw records were already enough to show that Cole's original report had told an incomplete story.
Evelyn called Cole back to the county administration building and asked Owen to attend as the witness from the termination meeting. Martin placed the source report beside the sheriff's certified summary. The original username appeared in both, but the gateway field did not appear in the summary Cole had described as complete. Evelyn asked whether he had known about the distinction when he dismissed Maya.
"I knew her credentials were attached to the extraction," Cole answered.
"That wasn't my question."
"The report identified her account as the account used."
Martin asked who possessed privileges to generate or delegate credentials through the gateway. Cole began to answer, then stopped when Martin said the inspector had already requested the full list. The sheriff folded his arms, as though the question of administrative access were a challenge to his rank rather than a factual part of the investigation.
"This doesn't clear Williams," Cole said. "She may have found another way into the system."
"Do you have evidence of that?" Evelyn asked.
"We're still gathering it."
The answer altered the atmosphere. That morning, Cole had described his evidence as sufficient to end a command officer's eighteen-year career. Now he was acknowledging a factual explanation remained to be established. Martin looked toward Owen, who had his notebook open on the table.