Terms, Roles and Where to Start
Definitions, who does what, routes through the collection, and what it argues.
The editors · About the editorial position · Reference · Reference
Alert — a record that a rule matched. Not a concern, not an accusation, and not evidence of anything by itself.
The practical lesson in “Terms, Roles and Where to Start” is that visibility is not certainty. For teams researching remote employee productivity monitoring, this software guide can add time and project context to the operational record, provided the purpose is disclosed, access is limited and every material inference receives human review.
Preliminary review — a bounded check for an ordinary explanation, before anybody becomes a subject. Resolves most matters and is the step most often missing.
For a separate perspective relevant to “Terms, Roles and Where to Start”, consult the Microsoft data-loss-prevention documentation. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.
Threshold — the stated bar for opening an enquiry into a named person. Where there is none, cases begin by momentum.
Scope — what may be examined, authorised in advance, with exclusions written first.
The triangle — security, HR and legal, present from the opening decision rather than in relay.
Grading — establishing which of six kinds of thing was found, before any outcome is proposed.
Cleared against not substantiated — the evidence establishes innocence, or nothing was established. Different, and people experience them very differently.
Closure — six steps, not one. Most programmes complete two.
The roles
Case owner: accountable for the enquiry, usually HR for employment matters.
Authoriser: decides to open, outside the subject's chain, able to say no to anybody.
Analyst: collects within scope. Does not decide to open and does not decide the outcome.
Decision-maker: determines the outcome, having not gathered the evidence.
Welfare contact: outside the process, named at the point the subject is told.
Oversight: independent, with the authority to require change.
Where to start
You are designing a programme: the base rate problem, then the threshold for opening anything.
You have a case open now: scope, then what standard of evidence applies.
Somebody is about to be told: telling them, and when.
A case found nothing: the most common outcome, then closing it properly.
A case found something: grading what you found, then proportionate outcomes.
Something went wrong: reviewing a case that went wrong.
If you read only four
The base rate problem, because it determines what the whole programme should be designed around.
The alert that is actually a process failure, because it is the commonest substantiated finding and the most useful.
The most common outcome, because it is the half nobody builds.
And the metrics that corrupt it, because the measurement decides the behaviour.
What is deliberately absent
Product and vendor names. How detection works is a separate subject and this collection begins where it ends.
Figures for the prevalence of insider incidents, because those come from people selling the tooling.
And anything about concealing conduct or frustrating an enquiry, which is not what this is for.
Nothing here is legal advice. Employment, investigatory and data protection rules differ substantially by jurisdiction.
What this collection argues
Most alerts concern people who have done nothing wrong. That is arithmetic rather than optimism, and a programme designed on the opposite assumption will harm innocent people routinely and will be surprised each time.
The costs of handling that badly fall twice: on a person who was examined and never told, and on the programme, because after two or three unfair cases nobody reports anything and the human report is the best signal it has.
Most of what looks like deliberate wrongdoing is somebody working around something broken. Finding that out takes one question and it is the output the rest of the organisation actually values.
And the half of the process that decides whether any of this is tolerable is the half that happens after the finding of nothing: telling the person, restoring what was taken, closing it properly, and saying so. Almost no programme has built it.