Most estate administration systems treat storage as location. A safe is 'where documents live.' A bank box is 'where valuables are kept.' A password manager is 'where credentials are stored.' This is backwards. Storage locations are not containers. They are routing points in a custody topology. The question is not what lives where, but how an operator reaches what they need when the principal cannot help.
What a Designated Place actually is
A Designated Place (DP) is not a physical location. It is a routing specification: a place with a known access method, documented independently of the principal's presence. A home safe whose combination exists only in the principal's memory is not a Designated Place — it is an access barrier. A home safe whose combination is documented in a sealed envelope held by the appointed operator becomes a routing point: the operator knows how to reach it independently.
A functioning DP topology requires three properties. Independent access: the operator can reach the place without the principal's assistance. Non-circular routing: the access method for Place A cannot be stored inside Place A. Documented paths: the operator knows where each DP is, how to access it, and roughly what it contains.
Why physical sovereignty still matters
Digital storage is convenient. Cloud folders sync. Password managers centralise credentials. But convenience can introduce single points of failure. Cloud platforms gate access behind authentication layers. If the operator cannot authenticate, the entire information structure is inaccessible. Physical custody, by contrast, allows routing through independent paths.
A resilient system uses both. Digital platforms for operational convenience. Physical custody for independent routing when the digital layer fails.
The minimal viable topology
Three Designated Places. DP-01: a password manager (centralised credential access; operator has independent access via emergency kit in DP-02). DP-02: a physical location controlled by the principal (typically a home safe; contains the password-manager recovery kit, critical physical documents, and access instructions for DP-03). DP-03: a physical location held by a third party (typically a bank deposit box or solicitor custody; contains copies of key instruments and backup credentials).
The topology ensures that no single point of failure locks the operator out completely. The minimum is two independent paths. Three is more resilient.
Common anti-patterns
Three patterns break most topologies. Circular dependencies: the safe combination is in the password manager; the password-manager recovery kit is in the safe. Co-location: the home safe and the backup key to the safe are in the same location; a fire eliminates both. Undocumented routing: the operator knows 'there is a safe somewhere' but not where it is, how to access it, or what it contains. These are not hypothetical edge cases — they are the dominant failure modes observed during continuity drills.
A topology is not a theory. It is a system that either functions or does not.