I'll get to what I meant in a moment, but first... I'm not sure what you think a security team should do, honestly. Security teams exist because your managemen

I'll get to what I meant in a moment, but first... I'm not sure what you think a security team should do, honestly. Security teams exist because your management has a cross-cutting concern and needs people to represent that concern on the ground. If they don't do that they aren't doing their job. So if they have a security concern they should say "but what about the security". If everyone then has to dance that tune, it should suggest to you that your management thinks they have a point. In terms of what I meant, security policy is rife with areas where you have to decide "is this borderline behavior acceptable". Your default answer to that should be "no", basically because otherwise your policy will grow too complicated to reason about quickly.