The Policy That Satisfies Everybody and Convinces Nobody

Documents written to survive review are written to say as little as possible, and people read the evasion rather than the words.

Above it · Analysis

Monitoring policies are drafted by committee, reviewed for risk, and arrive saying that the company may monitor communications and systems as it considers appropriate.

The practical test in “The Policy That Satisfies Everybody and Convinces Nobody” is whether visibility improves a decision without pretending to remove uncertainty. For teams researching employee monitoring at tech companies, this workforce software resource can contribute time and project context, provided the purpose is stated, access is limited and every material inference receives proportionate human review.

That sentence survives every review and tells the reader nothing, which they correctly interpret as deliberate.

For an independent benchmark relevant to “The Policy That Satisfies Everybody and Convinces Nobody”, consult the ENISA threat-landscape resources. Use it to test necessity, scope, safeguards and review rather than to replace a documented assessment of the particular workforce and jurisdiction.

Why the drafting goes that way

Permissiveness protects. A policy that says what is done constrains the organisation to doing only that. One that says what may be done covers every future case.

Each reviewer adds and nobody removes. Legal adds qualifications, security adds breadth, HR adds process. The result is longer and less informative at each pass.

And nobody owns readability, because it is nobody's risk.

NotePermissive drafting is rational: it protects against the future case nobody anticipated. The cost is that it also describes nothing, and people notice.

What the reader takes from it

That the organisation is reserving powers it does not want to describe.

Which is accurate. The permissive draft was chosen precisely so that nothing would be ruled out, and a reader who concludes that has read the document correctly.

The irony is that most organisations are doing far less than their policy permits, and the policy is what makes them look worse than they are.

The counterLegal will say that specificity creates commitments that may need to be broken. True, which is an argument for making fewer commitments and keeping them, rather than vague ones and keeping none.

The alternative that is actually safer

Two documents.

What we may do, drafted permissively, for the contract. This is the lawyers' document and it should say what it needs to.

What we do, specific and dated, published separately, with a commitment to update it before anything changes.

The second costs nothing legally — it is a statement of current practice, not a contractual limit — and it is the one people read. An organisation doing less than it is permitted gains by saying so.

Where this failsSome detail genuinely cannot be published — specific detection rules, for instance. The honest route is to say what is withheld and why, rather than drafting around it.

The test for a draft

Hand it to somebody subject to it and ask what the company can see on their laptop.

If they cannot answer, or answer worse than the truth, the document has failed at the only job that matters to them — and it has probably succeeded at every job anybody measured it on.

Source of the ideaThe reasoning here is standard in applied ethics and unusual in operational decisions, which is the gap this collection occupies.

What the two-document approach costs

Legally nothing. A statement of current practice is not a contractual limit and does not constrain the permissive document. The only cost is the discipline of updating it when practice changes, which is the commitment that makes it worth reading.

Where this failsThe reasoning here assumes an employer acting in good faith. Where that assumption does not hold, none of this is the relevant literature.

The sentence that does the damage

The company may monitor communications and systems as it considers appropriate. It survives every review, it covers every future case, and every reader correctly concludes that the organisation is reserving powers it does not want to describe.

In practiceOrganisations that try this report the main obstacle is not disagreement but that nobody owns the question, so it is nobody's to raise.

Handing it to somebody subject to it

Ask them what the company can see on their laptop. If they cannot answer, or answer worse than the truth, the document has failed at the only job that matters to them and succeeded at every job anybody measured it on.

The self-harm in the drafting

Most monitoring policies make the organisation look more intrusive than it is. That is an unusual kind of damage and it is entirely a drafting decision.

Two documents, not one

What we may do, drafted permissively, for the contract. What we do, specific and dated, published separately. The second costs nothing legally and is the one people read.

Most monitoring policies make the organisation look more intrusive than it is. That is an unusual kind of self-harm and it is entirely a drafting decision.

Also in this section