Chapter 31
The first draft of the Expert Safety and Public Access Framework cost more than the institute wanted and less than the institute had already asked individuals to absorb.
Leona wrote both facts at the top of the policy session’s whiteboard.
Around the table sat Renée, counsel, department leads, two staff representatives, the outside project lead, and a labor consultant. Kieran and Abel joined only for the sections within their professional scope. They were resources, not authors of the institute’s values.
“We need a framework people can use before a threat becomes spectacular,” Leona said. “Not an executive panic plan.”
The team organized the draft around eight funded commitments.
Risk assessments based on exposure and role, not salary.
Vendor access control and time-limited data sharing.
Family-data separation.
A single reporting and evidence-preservation channel.
Staff training.
Mental-health support without stigma or public disclosure.
Criteria for temporary protection.
Continuity planning that kept work moving without treating the targeted employee as disposable.
Renée projected the first-year estimate. “If we implement all of it, we freeze two open positions and reduce discretionary travel. The recurring cost is lower, but it is not trivial.”
One staff representative, a research coordinator named Maya, said, “Neither is changing my phone number because an event vendor gave it to three subcontractors.”
“Agreed,” Renée said. “My job is to show the choice, not deny the need.”
Leona appreciated the shift.
They debated protection criteria. Executive visibility could not be the only trigger.
Credible specificity, family exposure, repeated conduct, building access, and role criticality all mattered.
Protection would be temporary, reviewed, and separated from romantic or supervisory leverage.
No employee would have to accept unexplained restrictions unless immediate safety required action under a defined contract.
Kieran spoke from the screen. “Build decision points into the policy. Staff should know what indicator changes a recommendation into a required safety action. Vague discretion invites overreach and inconsistent treatment.”
Leona did not react to the private echo of those words.
Abel followed. “Family data should have a separate owner, access list, and retention rule. Continuity plans need a deputy for critical public functions so an employee can take temporary protection without believing the institution collapses in their absence.”
“Does that encourage removal?” a board observer asked.
“It reduces coercion,” Abel said. “If the work dies when one person steps back for forty-eight hours, that person is not choosing freely between safety options.”
The answer settled over the room.
At lunch, Kieran and Abel left the call. They did not remain for informal conversation. Their absence was another boundary correctly enforced.
Renée closed the budget file. “We cannot afford every desirable safeguard at the highest level.”
“Then tier the measures by exposure and credible conduct,” Leona said. “Do not make them symbolic.”
“The board will ask why existing insurance and police response are insufficient.”
“Because insurance pays after loss and police enforce law, not organizational continuity.”
“They will ask whether public employees accept visibility as part of the job.”
Leona’s voice sharpened. “Visibility is not consent to expose a daughter’s address. Criticism is not permission to threaten a receptionist. We have been externalizing public access onto private bodies and families because the costs do not appear in our budget.”
Silence followed.
Renée looked at the figures again. “If we phase vendor controls over six months and negotiate the mental-health contract across two partner institutes, I can protect one of the hires.”
“Do it.”
“We still lose travel.”
“Then we lose travel.”
The decision was not brave. It was governance.
By five, the framework had owners, draft funding, review dates, and a provision for staff feedback. It also had a sentence Renée insisted on adding: Safety decisions should preserve the targeted person’s agency to the maximum extent possible without shifting unmanaged risk onto coworkers.
Leona read it twice.
“That is better than my version,” she said.
Renée looked suspicious. “Are you unwell?”
“Do not make this difficult.”
They left the conference room together.
The independent protection officer waited near the elevators, not blocking Leona’s route. She explained the car change before asking whether Leona wanted the alternate departure.
Leona said yes.
The choice felt ordinary.
That was what good safety should become.
Implementation immediately made the framework less elegant.
Human resources wanted reports routed through managers.
Staff representatives objected that a manager might be the reason an employee feared retaliation.
Counsel wanted evidence preservation broad enough to support legal review.
Privacy staff warned that overcollection could create a second archive of distress.
Leona required one intake channel with role-based access and a choice to report confidentially. Safety triage would remain separate from performance management. The system would preserve necessary originals without circulating them to curious executives.
“What about false reports?” a department head asked.
Nadia, consulted only on process design, answered from the end of the table. “You investigate conduct. You do not make fear of falsehood the price of entry. Retaliation and deliberate fabrication have their own procedures.”
She did not invoke Society authority or hint that she knew Leona privately. Her contribution served the institute’s present need.
Maya asked that the mental-health benefit include sessions for family members directly affected by data exposure. Renée calculated the cost and proposed a capped emergency allocation.
“Approved for the draft,” Leona said. “Bring usage review after six months. Do not require family members to disclose session content.”
By the time they adjourned, the whiteboard had arrows, exceptions, and three unresolved questions. The framework was becoming real because people had found where it could fail them.
Leona remained with Renée to clear the room.
“You know,” Renée said, “I thought you wanted the policy to justify appearing in person.”
“At first, perhaps.”
“And now?”
“I want the appearance to prove the policy serves a purpose. Different direction of causality.”
Renée handed her a marker. “You make even humility sound like a footnote.”
Leona smiled. “Occupational hazard.”
They left the unfinished board exactly as it was. Structural responsibility was not clean enough to photograph and declare complete.
The staff representatives returned seventy-two comments. Some contradicted each other.
One employee wanted mandatory manager notification for every report. Another feared managers most. Some wanted public transparency about threats; others wanted strict confidentiality. Remote employees needed different protection criteria than staff entering the Washington building.
Leona resisted the executive impulse to resolve conflict by selecting the view closest to her own.
The framework created a minimum standard and routes for choice.
Immediate safety facts could be shared on a need-to-know basis.
Broader disclosure required consent or legal duty.
Managers received operational instructions without private content.
Employees could name a support person. Remote risk assessments covered home-office exposure without requiring interior access by default.
Renée added cost ranges to each option.
“This is less quotable now,” she said.
“Good policy usually is.”
They scheduled an annual audit with staff participation but did not create a new formal council. The structure served the institute’s actual governance rather than borrowing symbolic machinery from elsewhere.
Leona approved the second draft for board review.
The framework had begun as her demand. It was becoming something other people could own.
Ownership changed the next morning when staff returned forty-three comments.
Several objected to the proposed supervisor notification.
A person reporting a threat could choose to notify a manager, but automatic disclosure might expose domestic abuse, health information, immigration concerns, or private relationships.
Leona had approved the automatic rule because managers controlled schedules.
Maya challenged it. “A manager needs the work impact, not the whole event.”
They divided the flow. The response team would receive the report. Managers would receive only necessary scheduling and safety instructions unless the employee consented to more. A confidential officer could approve leave and expenses outside the ordinary chain.
Finance resisted reimbursement without manager signoff.
“Then finance becomes the disclosure point,” Leona said. “Build a coded authorization with audit rights that do not include the private narrative.”
The labor consultant warned that perfect confidentiality was impossible when operations changed visibly.
“Then say that,” Leona replied. “Do not promise secrecy the institution cannot deliver. Promise minimum necessary disclosure and explain who decides.”
Another comment asked whether a person could bring a support person to threat meetings. Counsel worried about privilege. They designed options: a union representative, advocate, colleague, or chosen support person after a short confidentiality explanation. Legal advice remained distinct.
The revisions added cost, time, and human friction. They also made the framework usable by someone who did not possess Leona’s title or comfort confronting a room.
At the board pre-brief, a member asked whether the institute risked encouraging excessive reports.
“We are likely to receive more reports,” Leona said. “That may indicate access, not more danger. We will measure response quality, time, repeated conduct, employee impact, and whether controls improve. A lower number is not automatically success if people stopped trusting the channel.”
“What is success, then?”
“People receive relevant information, retain meaningful choices, and can continue or change their work without bearing institutional failures alone.”
It would never fit on a donor placard.
The board member wrote it down anyway.