Very true. However, when creating security policy, one should always keep in mind those that have permission to access information, rather than those that have

Very true. However, when creating security policy, one should always keep in mind those that have permission to access information, rather than those that have actual access to information. It's a nightmare to me that there could be 15 people that have actual access to information, but a random official in the chain of command could give any one of 1.4 million people access to it without any further vetting.