You cannot write a personnel policy that protects a database from people who never signed your contract