> Sure, good question. Have you ever built/audited IAM policies before? That helps with understanding the context. Yes, I have been working in regulated indust

> Sure, good question. Have you ever built/audited IAM policies before? That helps with understanding the context. Yes, I have been working in regulated industries for a while in devops and security roles. > So, HR loses legal precedent to support their firing, which isn't an area HR loves being in I think. I think this is the crux of it, frankly. People can be fired for arbitrary reasons, including violation of company policy, even if that policy is not backed by force of law. If you perform unauthorized access of customer info willfully and that is in violation of policy, why does HR need the force of law? If you were a key holder and repeatedly left the door unlocked at close despite previous warning, while not violating the law you should likely be let go.