So in this case he actually changed someone's password - don't they have a policy saying that you have to only do this kind of stuff with your own account or in

So in this case he actually changed someone's password - don't they have a policy saying that you have to only do this kind of stuff with your own account or in a sandbox? Or is this exempt because such a thing is not possible since it's internal?