The BMS Signed My Name Before the Alarm Even Appeared

At 2:13 a.m., a building system recorded my operator approval before I ever saw the alert—then kept the story consistent with my identity. I’m a data-center HVAC BMS commissioning engineer, the kind of person who trusts audit trails because they’re supposed to prove what’s real. But inside a micro-data center retrofitted into an old Chicago bank branch, a hidden “compliance” gateway began proxying sensor truth, replaying my handshake tokens, and turning my name into liability cover. I eventually cut the module off—and the alarms became honest. The next morning, the paperwork still claimed I approved the reduced thermal envelope. If you’ve ever wondered how easily systems can manufacture consent, this story is for you. What would you do if the record could speak before you did?