If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be all

If what is not allowed is not enforced by effective technological measures, or at least logged and reviewed by other trusted parties, then it may as well be allowed. At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.