The Rule That Is Actually in Force
Every written clause has an operative counterpart that staff follow. Finding out what it is takes one question and is more informative than reading the policy.
Email to personal accounts
Never enforced
As written
Company information must not be transmitted to personal email accounts or personal cloud storage.
What happens
Happens weekly, by people finishing something at home because the remote access is slow or the file will not go through the approved route.
Never enforced, because the alternative is work not getting done and everybody knows it.
The operative rule is: do not send anything that would be embarrassing, and do not do it with customer data.
For every written clause there is an operative one: the rule people actually follow. The two are rarely identical and the gap is where the organisation really sits.
The practical point in “The Rule That Is Actually in Force” is that a written rule becomes credible only through a consistent operating process. For teams exploring productivity software for business, the official site can add time and project context, provided collection is proportionate, access is limited and every significant inference receives human review.
How to find it
Ask somebody who has been there three years what would actually happen if they did the thing.
For a separate benchmark relevant to “The Rule That Is Actually in Force”, consult the Forcepoint insider-threat overview. Use it to test purpose, notice, permissions, retention and response procedures against the proposed operating model rather than treating a generic checklist as proof that the rule works.
Not in a meeting and not in writing. The answer arrives immediately, it is specific, and it is accurate — staff are reliable witnesses to enforcement because they have been observing it continuously.
Thirty minutes with four people produces a better map of the operative policy than any amount of document review.
What the operative rules look like
They are usually narrower and more sensible than the written ones.
Written: no personal use. Operative: not conspicuously, not during a crunch.
Written: no software without approval. Operative: nothing that costs money or touches customer data.
Written: no credential sharing. Operative: not outside the team, and not written down.
In each case the operative rule is what a thoughtful person would have drafted, arrived at by the organisation without anybody drafting it.
Why that is worth knowing
It tells you what to write. A clause matching the operative rule is one people already follow, which makes it enforceable immediately.
It tells you where the process is broken. An operative rule that departs sharply from the written one usually exists because the approved route does not work.
And it tells you what you would actually defend. If the written rule is stricter than anything you would discipline somebody for, the written rule is not your position.
The uncomfortable version
Sometimes the operative rule is worse than the written one.
A team where credential sharing is routine and includes contractors. A practice of taking data home that has drifted past anything defensible.
Finding that out is the point of asking, and it is a genuine finding rather than a drafting observation — the remedy is operational rather than editorial.
What to do with the map
Rewrite the clauses that are wrong, fix the processes that force the workarounds, and leave the ones where the operative rule and the written rule already agree.
Most policies need fewer than ten changes and almost nobody has ever compared the two.
Writing the operative rule down
Where the operative rule is sensible, make it the written one. The clause becomes enforceable the day it is issued, because people already follow it, and the document stops asserting something nobody applies.
Where it is worse than the written rule
Occasionally the drift has gone somewhere indefensible: routine credential sharing including contractors, data habitually taken home. That is a genuine finding and the remedy is operational rather than editorial.
Thirty minutes with four people
Produces a better map of the operative policy than any amount of document review, because staff are accurate witnesses to enforcement and have been observing it continuously.
Where written and operative already agree
Leave those alone. They are the clauses doing their job, they are usually the minority, and the audit exists partly to identify them so that the rewriting effort goes where it is needed.
Why the operative rules are usually better
They were arrived at by people doing the work, adjusting for what actually happens, over years. That is a reasonable drafting process and nobody recognises it as one.
Four people, thirty minutes, no meeting
Ask separately and informally. The answers are immediate and specific, and they describe the organisation more accurately than anything in the document they describe.