When they're not adventuring, the PCs in my campaign own a magic item shop in a very large city. They have a staff, inventory, marketing, and in general it operates like you'd expect an item shop to operate (except a lot of their inventory is originally dungeon loot). This city has a criminal element. That means that theft is a risk. At low level their inventory was mostly mundane equipment and the occasional minor magic item, so security was limited to a guard and an alarm spell activated when the shop closes for the night, to alert the two PCs that were sleeping on the top floor.
They've outgrown that now, as they're level 8 and the quality of their loot (and inventory) has increased considerably. A low level fighter type is not an adequate guard against high level magic thieves, and with tens of thousands of gp of items in the shop, it's a tempting target. (Also the PCs themselves aren't always there and can now afford apartments, so they don't sleep there even when they're in town.)
I'm trying to figure out how a building like this would be defended in a D&D city. I'm interested specifically in night time when the shop is closed, as during the day it's in an area that's well patrolled by the city guard and heavily trafficked, so a full on raid is highly unlikely. Shoplifting can occur, but the staff are fairly keen-eyed so it's rare.
Some specific requirements:
- The building already exists, and is not designed to be fortified. It's a good building with two floors (and a basement) and is masonry walls & wood construction inside. The city government is not going to let them demolish it and put up a fortress, and for story reasons they have to stay in that location. (The main floor is their show-room, the top floor is private, and the basement is used to hold inventory and some other things behind a hidden secret door.)
- The building has to be inviting when the shop is open. The PCs income entirely depends on this, as their loot is sold in this store. That means it can't have disintegration traps that go off when someone's kid wanders into the basement. 🙂 In general, magical defenses must be able to be deactivated during business hours.
- As the shop sells magic items, people want to be able to inspect the merchandise. That means the building can't be covered in an antimagic field while the shop is open.
Specifically, the PCs are concerned about theft. Primarily of the "sneak in at night and rob the place blind" variety, as during the day the store is occupied and the city guard have frequent patrols in the area (trying to barge in and take stuff by force would not end well for the attackers unless they're incredibly powerful). Stopping shoplifting beyond that in a way that doesn't cause the customer problems is another issue, and they're not overly concerned about it (plus it's hard to shoplift full plate without being noticed).
The criminal element in the city ranges from petty thieves & con artists to a full blown organized crime operation. That operation has access to spellcasters. It would tax their resources to do something like teleport people into the building directly at night, but it's not beyond their means.
Suggestions that use D&D 3.5 source material would be ideal.
Best Answer
Security is always a function of risk mitigation. Specifically, it must cost less to secure the goods than the total value of the goods, and make accessing the goods a cost higher than the total value of the goods. What compounds this problem is that you're talking about doing this in a game that is designed to let "good guys" penetrate the defenses of "bad guys" and take their stuff. There is a severe asymmetric power relationship in terms of the options presented to defender and attacker, and fixing that relationship will make adventuring not particularly fun.
The majority of this answer will be a discussion of what it will take to fundamentally secure a location. I conclude with the minimum viable product for "hauling swag around and showing it to people." which is, effectively, a wise-guy with portable holes protected by a party.
How to secure a location
I'm going to ignore the "not allowed to demolish" requirement because most of the external infrastructure can be substituted in situ for the extant building. Assuming that their access control is lousy enough to have people wandering into forbidden areas, they deserve what they get. While the "whole hog" is likely impossible for them to accomplish, this answer should give a minimum reference for adequate security and the running of a cost-benefit analysis to see if the idea needs plot-armor to survive.
Now, in modern times, because people have risk mitigation strategies like insurance, and an adequate police force, The idea of not having a fortress is absolutely laughable, and should cause the advenuters to, indeed, laugh, pick up their stuff, and move to a less insane place.
At the end of the day, no automated defenses will be sufficient. The role of the lock rating (in modern security) is a perfect illustration of this. Locks are rated by tool and minutes. Specifically, how long, in minutes, will it take a given type of tool to bypass the lock? It then becomes very simple. Time patrols of "guys with guns" (the technical term) such that it is (theoretically) impossible to beat all the security measures before said "guy with gun" finds you.
Controlling the means of entry
The first thing is controlling means of entry. Given that the opposition has access to casters who can cast teleport, (sor/wis 5), That means that access to 6th or 7th level scrolls is not out of the question. Therefore not only are the players trying to defend against scry and die but... the scrying part can be accomplished by walking in.
Unfortunately, with all the teleport protection in the world, walls of force are depressingly necessary because of Passwall, Gaseous Form and Ethereal Jaunt. (Scrolls are incredibly cheap, relative to their spell counterparts. And we have to assume the budget for these crimes is at least 25% of the market value of the objects.
The minimum necessary infrastructure to assert "security" should be outer walls of force, then a prismatic wall, then another wall of force (with nice plastering and architecture glued to the outside, because there is such a thing as taste). The interior must absolutely be covered in an anti-magic field. (Treat this place like a diamond and enhanced uranium supermarket located in south-central Los Angeles that has daily specials on tritrium.) Thus, there are 4 "public" regions of the "store" with two critical private regions. The shop should be "open" 24 hours a day. First, because you never know when adventurers will need things, and second, it should always be operating on the same security footing.
The demilitarized pleasure garden and outdoor sales boutique
Public region 1: Outside the front steps. This should be a completely disposable bazaar where el-cheapo goods are hawked. You don't want to pass just anyone into your inner sanctum, and you need a demilitarized zone. (I recommend paying for a lovely garden with fountains). Put up as many detection wards as you can in public region 1, Be prepared to completely lose this zone to smash & grabs. (Remember passing adventurers need to see this place as a dungeon that's more profitable to pay for than to pillage. If you have less protections than the average dunegon with the stuff, than be prepared for "dungeon arbitrage" to occur as adventurers try to loot you instead of the dungeons.)
Still, it's a good way of unloading the "cheap stuff", generating goodwill, and establishing a defensive perimeter that isn't completely profitless. Also here is an important step of coming to an arrangement with the thieves' guild. This is effectively Morporkian Insurance, but do whatever it takes to have the guild agree to self-regulate when it comes to your shop. This will almost certainly cost money. Make sure it costs less than what you would otherwise lose from a successful burglary. (This whole setup., by the way, is why the whole idea of magical emporiums that aren't dungeons is rather silly.)
Zone 2: The mantrap tunnel and lounge
Zone 2 is your buffer zone. It contains the multiple walls of force and prismatic walls in an AMF and whatever alarms you can devise. Since Walls of Force are "one 10foot square per level" It should be quite possible to shape (and then plaster) these appropriately such that you have a tunnel leading in.
This tunnel (covered in the anti-magic fields. plural.) should be the only way into the "shop", and must be securable at both ends. It must be a mantrap, and at least one of the authentication factors must be a token (marked with wizard's mark, changed daily) handed to the entrant from outside, and the other should be a one-time use challenge phrase established with the creation of the token, manipulated by a secret known only to the token giver and never divulged. (of course keeping that secret secret is a challenge left to the players.)
Still, this allows for positive vetting to occur before people enter the tunnel and the doors (if made well) should be proof against most mundane manipulation without magic.
If possible, dress up the security vetting as a public service. Maybe serve coffee or something.
Don't forget, all this security should be a profit source. Don't be afraid to lease vaults and secure meeting rooms for an exorbitant monthly fee. This location should be proof against most scrying, and, when combined with positive identity vetting, is a service that many people should be willing to pay for, especially on guarenteed neutral ground.
Zone 3, Bar, bistro, and "look, but don't touch" gallery.
Public region 3 is the shop's main floor and should be the gallery of magic items (isolated from the purchasers by walls of force.). A purchaser may, of course, request to be taken down to the firing range (region 4) to examine the item. Again, make this place a profit center by providing a security-enhanced bar and bistro to make money off of the floor space by letting people use it as neutral ground.
The firing range
The firing range, unfortunately, cannot be covered by an anti-magic field, but should be part of the walls of force barrier-complex, separated by both a mantrap and a specific, isolated, system for passing items to prospective clients. Making sure that dupes aren't substituted is, as always, left as an exercise to the players, but having arcane marks on all items is a good first step, as an arcane mark (both visible and invisible) is theoretically impossible to forge (See: harry potter and the natural 20). Personally, the best way to do this is to provide the item (in exchange for a deposit plus one hundred gold). Then to offer the customer a coffee, a meal, and a lovely chat (don't forget to upsell consulting services) while identify is cast on the item before it's returned. I recommend making an item of identify, as this is something you'll be casting all the bloody time.
Your (extraplanar) Vault.
The fourth location is your "vault." Start by making an extraplanar space with genesis (power crystals are amazingly affordable when one considers the cost of losing all these valuables.). Items that you don't want to lose to disjunction, items being stored securely (did you know that goldsmiths often functioned as banks because of the quality of their vaults?) and personal quarters should be there. Most games require knowledge of the "key" (nominally a specific frequency or somesuch) to access specific extra-planar dimensions. If your game doesn't, go loot the plane of earth's infinite gem supply until it does.
Passive security provides enough time for the "guys with guns" to arrive. Without active defenses, all the passive defenses in the world are pointless.
At the end of the day, hire enough "guards" (however one operationalizes that term) such that you have an adequate response force for each zone. Your budget for each zone should be the replacement cost (less your profit margin) of the items in the zone.
How to secure goods "on a budget."
Unfortunately, 11th level (either of yourself or opponents) is where dedicated powerhouses who want to do a single thing "well" really start to shine.
Assuming that you cannot protect a location, protect people instead. Start by getting a number of portable holes and securing them on the person most resistant to pickpocketing (maximize their spot check). Make them resistant to potions of glibness as well (left for another question.) They are your vault, as you'll store everything but bags of holding in these portable holes. You won't have a "home base" that can be attacked when you're not there.
This won't protect you from scry and die, but it'll at least make your death personal.
In terms of showing off the items, make books. Each book should be a catalogue and gallery, and have a well secured "vault and firing range" where you can hand a specific item to someone without giving them access to the portable hole.
You are not making a "toy store" so don't pretend you are one.
How to secure against "high level magic thieves" as a Level 8 party
Step 1. Pour yourself a lovely drink. I'm going to detail my assumptions.
Assuming that we're doing location based security, the first thing to do is to establish loss-thresholds. The party should have a net value (assuming wealth by level is appropriate) of around 27,000*5=135k (assuming a 5 person party.)
As this is a plot-based location, in many ways, I will assume that it has a net value of 20% of their worth, separate from their net worth. (Value therefore of 27k) I will assume that it has items of value to take them to level 9, of approximately 45k sale value. I will assume that you've completely obliterated the "traditional economics" of D&D (long may they burn) and are allowing the players to sell goods at their "full" price.
I will assume the thieves' guild is rational, can do cost-benefit analyses, and doesn't have access to the wish economy. I will also assume that they scale with the PC's level, functionally being able to dedicate 2 attempts of a well stated 5-man team to attack the store, if it is profitable.
I will assume (mmm, so very many assumptions) that thieves take a discount when fencing goods (And that there are no suitable goods for thieves to steal that are of immediate value) of 75%. I will also assume that thieves are not willing to spend more than 25% of the gross, because they don't understand economies of scale and because plot.
Therefore:
Defense budget for the store: 27,000 gp, access to an "in-party" wizard that can make custom magic items for cash.
Maximum attack budget for the thieves: 8437.5 gp (utoh...)
The party of high-magic thieves (mainly because I've been watching leverage) consists of a Mastermind, hitter, "hacker" (wizard), thief, and grifter. Mastermind is , called "Nate." Illumian Archivist 1/Wizard 1/Theurge 3/Dweomerkeeper 2 Grifter "Sophie" Changeling Beguiler/7 Shadow Adept/1, Hitter, "Eliot" (Given that this is a retrieval specialist) Wizard/1 Binder/1 Anima Mage/6. Thief "Parker" factotum/8, Hacker Gnome Illusionist 5 /shadowcrafter 2/shadowcraft mage 1 (she'll be better in 2 levels).
Roughly speaking, they have 3 avenues of attack: The Con, the Lift, and the Hit.
Confidence games in 3.5 are ... boring. Sophie decides to go for a maximum risk bluff, basically that she's someone who can treble their money in a month because she'll be using this to fund a group of adventurers to assassinate red dragons. We'll be... charitable and provide a +20 bonus on the sense motive check. She'll cast glibness on herself for a +30 untyped bonus, they'll hire a psion to cast conceal thoughts for +10 circumstance. We'll say +5 from various and sundry bonuses and magic items. (probably low), so +45+12+4 = +61 versus sense motive of ... +20.
The PC invests the shop, pausing only to let sophie bluff the rest of the group.
I honestly have no idea how to buff sense motive by +51 with less than 20k of resources. (Probably a good question for the site.) Let's ... assume that... sophie is having a bad hair day and just won't run a con because the entire subsystem is boring.
We'll ignore the hit, as that's combat and... well within the rules of normal combat.
This leaves the lift.
Pay someone to cast ethereal jaunt (doesn't trigger alarm), gives huge bonuses to hiding. Use ghost touch gauntlets to lift physical items into a pouch of holding (if necessary, coated in ghost touch oil). Leave when you have all the best loot. Shrink item as necessary.
Thus, the building has to be proof against trivial entry. It must have seamless metal walls (at the very least) to block passwall. (A few castings of wall of iron settles that nicely.) Zone of Respite (Spell compendium) protects against all of these things, Sor/wis 5, ... for minutes. Zone of Revelation is also a useful counter against invisibility. I would ask my players to agree on a house rule allowing these to be made permanent (with the understanding that enemies will use these techniques). I'd still keep everything in a secret chest and keep the chest token on the PCs, but it's a worthwhile protection method.
Combine the two, with a good authentication scheme to allow access inside and a catalogue of offerings (pricey magic items by appointment only, the item price needs to be posted to a third party as escrow),
While it's not amazing, it'll be proof against most boring instant-win attacks at level 8 (that don't use skills) and a reason to structure adventures around the thieves' guild. (We'll set aside the use of dispel magic to just ignore all of these protections. And we'll set aside the use of a hand drill to get through the walls.)