I'm trying to figure out what sort of magical and mundane methods protect the Great Library at Durenmar from destruction, theft and ... what today one would call "unauthorized appropriation of intellectual property". I want to give my players, who are brainstorming about a grand sting, a fair opposition -- meaning I'll think of the opposition they'll face before they tell me how they plan to face it. I think that the collective wisdom of the forum will provide a better model of the collective wisdom of dozens of magi over the centuries than just my own thinking. How would you protect the Great Library?
The risk/reward profile is not good. Not sure it's worth going through too much detail. The risk of getting caught is just too dangerous for me...
I've heard countless stories of people who commit crimes only to be undone by their big mouths. Armored car heists are illustrative of this. Also, there's the issue of whether they are observed to see Arts growing in excess of what seems reasonable.
Are you trying to find a way to discourage your players, or find a way for the players to pull off a legitimate grand heist against Durenmar?
I want to give them the stiffest opposition I can think of, but I do want to be fair: I'll think the opposition first, and see if they can breach it.
Incidentally I really think Durenmar cannot, by the Code, deny access to their Library even to magi who are unable or unwilling to contribute to it: the Bonisagus oath is to share all magical knowledge acquired, regardless of whether other magi reciprocate. Otherwise magi of other houses could simply say: "Sure, I'll give you my apprentice, but of course you first have to find me another one!".
Devil is in the details. Costs money to store and maintain books. They are just recouping costs. Also the library is small, only so many can be hosted, those who pay or provide service would always be ahead of the freeloaders.
Also, one presumes that part of the payment is for boarding fees, and not even access to the library.
I think the first defense should be a small dark room about 3' deep to get in. One door is magic to stay closed if the other is open. If both doors are closed, a high penetration magic item does InCo spell looks for a hidden tattoo or mark that identifies the librarians. If it doesn't find the mark (hidden in private place or under hair), it teleports the person out of the tower.
SEcond, before any book is taken back into the the main library collection, a magic item that does multiple arcane connection destruction spells are directed against the book to insure no one has hidden a connection in the book so that they can sneak into library that way.
I have a feeling that no matter how much defenses there might be(and my guess would be that they are easily enough to deter most), the big problem will be afterwards. When the Durenmar mages declare wizard war or perhaps simply offer up a huge bounty on the perpetrators. Or perhaps something more "inventive".
I'd suggest Clarifying the greatest - most worthwhile - works. That means they cannot simply be copied, nor can they be carried outside the aura without destroying them (and good luck with eluding the quaesitorial investigation on "who destroyed the Foundations of Hermetic Theory written by Bonisagus' own hand"...).
I would also place a "Shifting Dance of the Rebellious Ink" effect on the rooms of the library - which would scramble any ink or marking as it is being applied, making them unreadable.
Add in (Rego Vim?) spells against teleportation.
Add central registers with arcane connections to the books, enchanted to keep all books within the library.
Add an aegis of the hearth covering the library (only).
Add spells physically protecting the books from harm, such as ReFo spells or wards.
However,
Are you trying to find a way to discourage your players, or find a way for the players to pull off a legitimate grand heist against Durenmar?
[/quote]
Precisely. People don't steal from Durenmar for the same reason they don't violate the Hermetic Oath - it's not upheld magically, it's upheld politically.
Also, all of the above won't help against someone memorizing the books and thus, slowly, trascribing them. I'm not sure anything can be done about that without scrying.
Some generic "Faerie Curse' against anyone copying or stealing the books would be most effective; however, this is not Hermetic, so not apporpriate methinks.
The Code means what it is politically decided it means. 
The Bonisagus can write-off their obligations with "symbolic" reprieve from the visiting magi much like Bonisagus the Founder was not under any obligation to teach any student that came to his doorstep, on any topic, at any time.
Just make it simple:
The library is the Sanctum of the Librarian. The office of Librarian gives quite a set of scrying devices used in his sanctum (which would be ok with the code, I think?)
All books have ACs (fixed) in Durenmar's posession. And there is a set of maps that shows where each book is at any time.
Any book not signed out by the librarian will set off an alarm with Philippus of Niger...
Durenmar does have a rather hefty "retrieve the missing book" item.
The Library has a separate Aegis without any tokens produced. (Inside the ordinary Aegis of Durenmar.)
I really think that is enough. And then you have the political issues on top of it.
It might very well be that a paranoid librarian installs some "detect and destroy" all magic in the library also, but having a strong Aegis that you need to take down the Durenmar Aegis (or register as a guest within it) to target stops most magic...
And in "my" Durenmar you never get to remove the originals from the library. They are studies there. The books that can be copied can be removed, but they have fixed ACs left within Duernmar and there is probably little (legal and political) trouble for Durenmar to set of a horrible fireball (or rot-curse or something) centered on the stolen book...
I agree, Combined with:
which I also completely agree with, means that if the characters manage to sneak in, copy and/or study the books, and get out... Durenmar will not be able to prosecute them in front of the Tribunal, because they have accessed knowledge that was their right to access, without inconveniencing other magi.
GotF explicitly states this is not the case; the Sanctum of the Librarian occupies the two top floors of the library, but most Summae, Tractatus and Lab texts are outside of it. Which makes sense, since magi study in the library, and no one would want to study in another magus' sanctum.
With Vim, there are guidelines to reduce casting totals by (lvl + 4 magnitudes).
Have an item with T: Room, enough penetration, and this at, say, lvl 50.
All casting totals are reduced by 35.
Let's see how do they fare in a no-magic zone 
A fairly simple combo can be an old fashioned alarm.
Circle of Tome Warding. prevents any leather and paper tome to enter or exit the library. If someone breaks the circle ward that surrounds the tower, an item wails in the librarian's sanctum. The durenmar people will be braking the ward regularly, but that is normal under the supervision of the librarian. The thing is that he is the one that knows the circular ward spell. If the ward is broken he will know. It is unlikely that people does not notice that something is amiss and then they will hunt you like a pack of rabid dogs with high penetration and scary spells.
EDIT: incidentally, the "no magic zone" is one of the most powerful traps in a sanctum I can thuink of. A lab that is basically closed to the outside world and where you use magic for illumination, see outside (window), pass the stone wall to enter and exit... and that has a "cast twice per tuern WoM on an item in the ceiling that only you know how to disable with a spell can leave the trespasser in the dark, unable to use magic and unable to leave. I can see a fae blooded guy (goblin) having this kind of trap in his lab.
I'd imagine actual defenses are light, area spells to deny parasites, fire and mold, a seperate and powerful aegis and maybe some wards on the windows and doors. Beyond that, maybe just a few bound spirits to act as observers and a few bound intellego spells.
The real danger is, as has been mentioned, what happens after you steal something from their library. The library at Durenmar is somewhat sacred, anyone actually stealing it can rapidly expect to have multiple wizard wars declared on them, in addition to whatever the tribunal decides. Getting marched is extremely likely. I'd expect to have a few angry archmages rouse themselves from their labs to visit retribution for "this abominable insult to our order, to the house of Bonisagus and to our highest ideals and traditions".
GEtting Marched is almost a certainty for you have stolen from the magic power of the order as a whole.
Sneaking in to copy books without paying the fees is something that is perhaps a much lesser crime. Still likely to get you a hefty penalty but because of the bonisagus oath, you might get away with it (other than a bunch of wizard wars). Actually stealing from it though is very bad.
A private aegis and ward against humans not bearing mark of 'X' could block most people and the ward could be in enchanted device that senses if ward goes down to recast it. In fact all the wards and protections/defenses could be in InVi devices that if defense goes down, it goes back up instantly as trigger.
Hmm, I don't think the Durenmar library would have that. Lots of magics in there to protect the books from decay and such. Plus, magi study in the library; subjecting them to something like this would be depriving them of their magical power. I can picture an old archmagus getting all cranky and stuff because he can't use Imaginem effects to compensate for his failing eyesight 
The latter argument also applies to a "concentric Aegis" which would also, incidentally, be pretty expensive.
Along the same lines, I think that a number of extreme surveillance tricks would not be acceptable, since they would violate the Code's prohibition against magical scrying. As I said, I do not want the players to succeed or fail: I want the conditions to be "realistic". This means not adopting measures that would create too much discomfort to the lawful users of the library.
I certainly do agree that getting caught stealing books (rather than information) from the library is an egregious example of depriving (virtually the whole Order) of magical power.
I could see a ton of Intellego aimed at the books themselves. Where they are. What condition are they in. What magic has been cast on them. Perfectly reasonable to monitor your own property for the safety and good of the order.
Information is the best security of all.
Keep in mind that per section of HoH:TL, you can scry to detect intruders and people trying to sneak into your covenant. There is nothing wrong with spells to do same thing for people coming into the library. I just would have such scrying spells be in magic items with triggers to teleport the person out of the library. If an unauthorized person finds themselves outside Niger's sanctum every time they snuck in, they might quickly stop trying to sneak in.
Yes, this seems to be the most sensible defense against "intelligent" threats (as opposed to fire, molds and vermin), and it does not violate the Code*. Keeping objects for decades or centuries under constant magical effects may warp them (as per RoP:M) but I tend to ignore that.
- EDIT: well, generally. Technically using magic to ascertain who has opened, touched, or used magic on one of the Durenmar books may skirt the No Scrying provision of the Oath -- you are prying into the potentially legitimate affairs of your sodales. However, I think in many cases the Tribunal would be extremely lenient; I guess it would depend a lot on how it is done and what the intent is.
The problem with this sort of approach is that Durenmar constantly has visitors, and at any one time there are probably at least a dozen "legitimate" magi in the library.
The books would be protected by T: Room magic items, IMO. These don't care about reduced casting totals, so long as they don't have to penetrate.
The deprivation of Magical Power, OTOH, is something else. I guess it'd probably follow the same "rule" of whether visitors to Durenmar are given a casting total or not.