Discretion and the Executive's Devices and Data

Wednesday, 14:20, at Harbourview Clinic. Kwame is at the desk of Fiona, the director of people, because her mail has stopped syncing and she has a meeting at three. To get to the mail profile he opens the file manager. The recent-files pane shows him, without his asking, a spreadsheet called "Restructure — consultation list" and a document called "Settlement terms — draft 3". A chat window behind the mail client holds a conversation with the chief executive about a named consultant. Kwame rebuilds the mail profile, watches the inbox fill, says "that's syncing now", and goes back downstairs. He has seen three things that fewer than five people in a building of four hundred are meant to know. The fix took eleven minutes. What he does with the other thing is the subject of this article.

Discretion, on a help desk, is the technician seeing what the work puts in front of them and treating it as not seen. It is not discussed, not copied, not written down, not alluded to, not remembered out loud. It is half of what VIP support means and the half nobody writes down, because everyone assumes it. An assumed rule is kept by the people who would have kept it anyway. It is broken by the one person who did not know. The executive's devices carry the organisation's most sensitive material, and the technician on them has more access than the auditors. This article is part of our VIP & Executive Support series. It is about saying the rule once, in writing, and then keeping it in a dozen small physical habits.

It covers what the technician sees and why it cannot be avoided, then the confidentiality standard said once and kept. Next come the screen that is turned away, in person and on a remote session, and the assistant's delegated access and the password that is never shared. Then come the note that records the work and nothing else, the edges in a table, and when discretion meets duty. A short war story and the discretion standard to copy finish the article, in that order.

What the Technician Sees

The technician sees everything, and no amount of care changes that. So the standard has to be about what happens next rather than about not looking. A mail fault means the inbox, with every subject line of every message from the board, the bank, the lawyers and the person being quietly let go. A file-sync fault means the recent documents, which are the documents that matter this week. A browser fault means the open tabs, which may include the executive's bank, their doctor and the job they are interviewing for. A phone fault means the photos, the messages and the calendar. The calendar shows the lunch with the competitor's chief executive and the appointment at the fertility clinic. A slow laptop means the running processes, the installed software and whatever is on the desktop, which on executive machines is usually everything.

Some of this is the organisation's confidential business and some of it is the person's private life. The technician has no way to tell which is which in the moment, so the standard treats both the same. Neither exists once the technician leaves the room. The executive knows the technician has seen it. That is the uncomfortable truth at the heart of this handling. The executive is trusting a person whose name they may not know with material they would not show their own deputy. The trust is only possible under two conditions. The desk must have a standard the executive can be told about in one sentence. Every technician who goes upstairs must keep it so exactly that the executive never has reason to wonder.

The second truth is that most breaches of discretion are not leaks; they are remarks. Nobody on a help desk copies the restructure list. Somebody says, at lunch, "I think there's a restructure coming". By Friday the whole floor has heard. The director of people spends a week finding out how, and finds a technician who thought a hint was not a disclosure. A hint is a disclosure. The standard has to say so, because the person who makes the remark will not have thought of it as breaking anything.

The Standard, Said Once and Kept

The confidentiality standard is a short written statement. It says what a technician may and may not do with what they see on a device or in an account. It is signed once when the person joins the desk and never repeated as a lecture. It is short because a long one is not read and a short one can be recited. It is signed once because repeating it implies the desk does not trust its people, which is corrosive. Enforcing it silently and absolutely implies that it does. The standard applies to every device the desk touches, not only the executive's. It is written here because the executive's device is where the cost of breaking it is highest. The list is also where the organisation will ask whether the desk has one.

The standard says five things. Nothing seen on a device or in an account is discussed with anyone, including other technicians, except where the fix requires it, and then only the detail the fix requires. Nothing is copied, photographed, screenshotted or forwarded except what the fix requires, and that is deleted when the fix is done. Nothing seen is written in the ticket beyond the fault and the fix. The existence of a document, a message or a meeting is itself confidential; "I saw a thing" is a disclosure. And anything that looks like a crime, a compromise or a risk to a person goes to the desk lead and nowhere else, which is the subject of a later section. Five lines. A new technician reads them, signs, and is told, once, that the desk has never had a breach and does not intend to start.

The standard is kept by habit rather than by memory, and the habits are physical. The next three sections are the habits. First is how the technician behaves at the desk and on a remote session. Second is how access to the executive's accounts is granted without credentials changing hands. Third is what goes in the note. Each is small. Together they are what the executive sees when they look up from the meeting agenda and notice how the technician is working. That is the only evidence of the standard they will ever get.

The Screen That Is Turned Away

At the executive's desk, the technician asks before opening anything, says what they are about to do, and works with the screen where the executive can see it. "I need to open your mail settings; I'll be in the account page and nowhere else." The narration is not for the technician's benefit. It tells the executive what is being looked at so they do not have to wonder. It keeps the technician honest in a way that silent work does not. If the executive is busy and the technician is left alone with the machine, the same narration goes in a message afterwards. For example: "Rebuilt the mail profile; opened mail settings and the profile folder; nothing else."

Search rather than browse. The technician who needs a file goes to the search box and types its name; they do not open the documents folder and scroll. The technician who needs a mail setting goes to the settings. They do not read the inbox while it loads, and if the inbox is on screen they look at the keyboard. When the fix means something must be scrolled past, the technician says so and does it quickly. Close what you opened, in the order you opened it. Leave the machine showing what it showed when you arrived. That is a courtesy and also a check. A desktop left in a different state is a desktop the executive will wonder about.

Ask before touching the phone at all, and hand it back for anything that needs the executive's own thumb or face. Phones are the most personal device in the building and the one the technician should spend the least time holding. If the fix is a setting, talk the executive or the assistant through it with the phone in their hand. If it must be the technician's hands, say what the screen will show before it shows it. The lost or stolen phone is a different and urgent matter with its own routine in Lost and Stolen Devices. Discretion there means acting fast and saying little.

On a remote session the same rules apply with one addition: consent, every time, stated and recorded. The executive or the assistant watches the screen while the technician works. The consent discipline is the whole of Consent Every Time and this article does not redo it. The executive-specific point is that the technician says when they have connected, narrates what they are opening, and says when they have disconnected. They do this out loud or in the chat, so that the executive is never uncertain whether someone is on their machine. Unattended access to an executive's device is a policy decision for the person who owns security, not a convenience the technician grants themselves. (The executive who says "just connect whenever, I trust you" is being kind. Write it down anyway, or decline it.)

The Assistant's Delegated Access, and the Password That Is Never Shared

The executive assistant works inside the executive's mailbox and calendar every day. The right way to make that possible is delegation. The assistant's own account is granted permission to act in the executive's mailbox, under the assistant's own name. That way, every action can be told apart from the executive's. The wrong way is the executive's password on a sticky note. It is wrong for the executive's sake as much as the organisation's. With a shared password, nothing done in that mailbox can be shown not to have been the executive. The kinds of access, send-as against send-on-behalf, calendar delegation, and the request form, are in Shared Mailboxes, Delegation and Who Can See What. The desk should set the assistant up from that article the day the assistant starts.

The desk itself never uses the executive's credentials either. The technician works through the desk's own administrative access, which is logged under the technician's name. When a fix genuinely needs the executive signed in, the executive or the assistant types the password with the technician looking elsewhere. "Can you just sign in as me and sort it?" is a request the technician declines with the alternative in the same breath. The alternative is almost always "if you sign in, I'll do the rest and you can watch". Where the executive insists, the request goes to the owner of the security policy, in writing. This follows the way Saying No Upward describes. In my experience it is never pursued, because the executive wanted the mail fixed, not the policy broken.

Delegated access is reviewed when the assistant changes, and that is the one moment it reliably goes wrong. The new assistant is set up on their first morning. The old assistant's access is removed by nobody, because nobody owned the removal. A year later a person who has left the organisation can still read the chief executive's mail. Put the removal on the assistant's leaver ticket and on the executive's access review. When the desk is asked "who can see the chief executive's mailbox", be able to answer from the directory rather than from memory.

The Note That Records the Work and Nothing Else

The ticket note is where discretion is most often broken by accident, because the technician is trained to write everything down. The executive's ticket is the one where "everything" must be smaller. The note records the fault, the cause, the fix, the device and the reproducible steps, and not one thing seen on the way. "Mail not syncing; profile corrupt; profile rebuilt; mailbox re-downloaded; tested send and receive" is a complete note. Consider this note: "Mail not syncing; mailbox large because of attachments from the law firm about the settlement; profile rebuilt". It has leaked a legal matter to every technician who ever opens the ticket. It has also leaked it to the auditor who reads the ticket export in three years.

Internal notes are not a safe place for the thing you saw. An internal note is hidden from the requester and visible to the whole desk, which is the opposite of what a secret needs. In QuerySolv, as in most tools, the internal note sits in the ticket's history beside the public replies for as long as the ticket exists. It is read by anyone with access to the queue. So the rule is the same for internal notes as for public ones: the work, and nothing else. The general discipline of what never belongs in a ticket, credentials, personal remarks, opinions about the requester, is in What Not to Write in a Ticket. The executive's ticket adds the contents of the device to the list.

The same restraint applies to the ticket's subject and to the requester's own words. An assistant who writes "Fiona's laptop won't open the restructure documents" has put the restructure in the subject line of a ticket the whole desk can read. The technician's first act is to retitle it to "Fiona: documents will not open" and to move on without comment. Nobody is reprimanded for this. The assistant did not know the ticket was visible to the desk. They do now, because the technician will mention it kindly on the next check-in. Screenshots attached to the ticket get the same treatment: crop to the error. If the error cannot be cropped from the content, describe it instead.

Devices, Data and the Edges

Most of discretion is the three habits above. The rest is a handful of situations that come up a few times a year and that a technician should not have to improvise. The table below lists them with what the technician does and what they never do. The right-hand column is the one to read twice. The left-hand column is usually obvious, and the breaches happen in the gap between knowing what to do and knowing what not to.

Two rows need a word. The shared-at-home laptop is a policy question, not a discretion question. The technician's only discretion job is to raise it once, quietly, to the lead, who takes it to whoever owns the device policy. The "off the record" request is almost always innocent: a person who does not want a mild embarrassment in a ticket. The answer is a plain note rather than no note. "Browser reset; bookmarks preserved" says everything the desk needs and nothing the executive minds.

When Discretion Meets Duty

Discretion has a limit, and the standard says where it is so that the technician does not have to decide alone at the executive's desk. What the technician sees may look like a crime, a security compromise of the executive's accounts, harassment, or a risk to a person's safety. If so, the technician does not investigate, does not copy, does not confront, and does not write it in the ticket. They finish the fix if it is safe to, leave, and tell the desk lead in person the same day. The lead takes it to the function that owns it. That is security for a compromise, the people function or legal for conduct, and the organisation's own escalation route for anything touching safety. The technician's part ends when the lead has it. The record of what was seen is made by the function that owns the matter, not by the desk, and not in the ticket.

The reason the technician does not investigate is not that they are untrusted. It is that investigation is a skill, a process and often a legal matter. A well-meant look at the evidence can destroy its usefulness or tip off the person involved. The desk triages and contains. A compromise of an executive's account is contained by the same routine as any account compromise. Sessions are revoked, credentials reset through the verification standard, and the security function told. The executive's device is the one where the desk moves fastest and says least. Forensic work, threat hunting and anything to do with legal process belong elsewhere and are referred to, not attempted.

The hardest case is the one that is none of these but sits uneasily. It might be the executive's open tab for a job elsewhere, or the message that suggests a relationship. Or it might be the calendar entry that looks like something the board does not know. These are the person's business and the standard says so: not seen. A technician who takes a worry about one of these to the lead is not breaking the standard; a technician who takes it anywhere else is. The lead's answer, nearly always, is that it is nobody's business, and the technician should expect that answer and be relieved by it.

A Short War Story: The Corridor Remark at Pennington Hotels

At Pennington Hotels, a group with eleven sites and a desk of five at head office, a technician called Ollie fixed a calendar-sync fault. It was on the operations director's laptop. Because the calendar was on the screen while it synced, he noticed an entry for the following week. It was headed with the name of a rival hotel group and the word "interview". He said nothing at the desk. At lunch on Thursday, with the operations director's name coming up for an unrelated reason, he said, "I wouldn't count on her being here long". Two people at the table repeated it to two more. On the Monday the operations director asked the chief executive why her own team had been told she was leaving. The trail led back to the desk in a day. Ollie was moved off executive work. The executive floor stopped letting the desk near their devices and brought in an outside consultant for six months. The desk lead spent, by his count, over thirty hours that half-year undoing the consultant's setups and rebuilding the standard that the desk had never written down. The operations director stayed, as it happened; the interview had been a courtesy. One remark at lunch had cost the desk a year of trust, and the standard that would have prevented it was five lines long.

The Discretion Standard

The standard below is one page. It has five rules at the top, signed once; the physical habits that keep them; what goes in the note; the duty line; and the sign-off. It is given to each technician when they join and kept where the desk can find it. It is also given to any executive or assistant who asks what the desk's rule is, because the second audience is as important as the first. Where the desk keeps a knowledge base with articles visible to agents only, as most tools and QuerySolv allow, the standard lives there with the charter beside it. Do not add to it. A standard that grows past a page stops being recited and starts being filed.

THE DISCRETION STANDARD — ONE PAGE
Desk: ______________________   Owner: ______________________   In force from: ____________

1. THE FIVE RULES (signed once by every technician)
   1. Nothing seen on any device or in any account is discussed with anyone, inside the
      desk or outside it, beyond the detail a fix requires.
   2. Nothing is copied, photographed, screenshotted or forwarded beyond what a fix requires,
      and that is deleted when the fix is done.
   3. The ticket records the fault, the cause, the fix, the device and the steps, and nothing seen.
   4. The existence of a document, a message, a meeting or a file is itself confidential.
      A hint is a disclosure.
   5. Anything that looks like a crime, a compromise, harassment or a risk to a person goes to
      the desk lead, in person, the same day, and nowhere else. The technician does not
      investigate, copy, confront or record it.

2. AT THE DEVICE
   [ ] Ask before opening anything; say what you are about to open and why
   [ ] Work with the screen where the person can see it; narrate when they cannot
   [ ] Search; do not browse. Look at the keyboard while an inbox or a folder loads
   [ ] Close what you opened; leave the screen as you found it
   [ ] Phones: hand back for anything needing the owner's thumb or face; talk them through it
   [ ] Remote: consent every time, say when connected, narrate, say when disconnected

3. CREDENTIALS AND ACCESS
   [ ] The desk never holds or uses a person's password; the person signs in, the technician works
   [ ] The assistant's access is delegated under the assistant's own name, never shared credentials
   [ ] Delegation is removed on the assistant's leaver ticket and checked at every access review
   [ ] Unattended access to a listed person's device is a decision for ______________, in writing

4. THE NOTE
   Write:   fault, cause, fix, device, reproducible steps, time spent
   Never:   file names, subject lines, contents, who the person was writing to, what was open
   Retitle a ticket whose subject reveals content; crop screenshots to the error or describe it
   Internal notes follow the same rule as public replies: the whole desk reads them, for years

5. WHEN ASKED
   By another executive what was on the device:  "The same standard applies to everyone;
                                                  I can raise it with ______________ if you need to."
   By the person for work "off the record":       "Every job is a ticket; the note will say only
                                                  what was fixed."

Read and signed: ______________________   Date: ____________   Lead's initials: ______

Kwame wrote "Mail not syncing; profile rebuilt; tested" in ticket 5108 and nothing else. He mentioned nothing at the desk. When Fiona's assistant called a fortnight later about a different fault, the assistant asked for him by name. The restructure was announced six weeks after, to a building that had heard no rumour. Nobody at the clinic ever knew what the desk had not said, which is the only form of credit discretion ever gets.

Frequently Asked Questions