Slide 23 of 57
Notes:
Also what monitored information can be received by a manager
Managers cannot be trusted to interpret authorisation policy
Need authorisation policy to specify how to control access to resources by all users not just managers.