content: That's fair enough.  If you don't want someone doing something, put it in a policy.  Make some basic controls around it, so you know they intentionally violated the policy.  Deal with the obvious management issue.  But whose fault is it if you're not breaking any rules?