Chapter 7
Three years after I moved into full-time operations, the estate created a new role.
Data governance manager.
I applied.
Did not get it.
An external candidate named Elise Morgan did.
She had ten years of privacy engineering experience.
I had three.
Fair.
I became her deputy.
That was better for me than a promotion I was not ready for.
Elise taught me something I had resisted.
“Policy is not a personality trait.”
I had become the person everyone called careful.
That felt good after what happened.
But careful can become rigid.
Then one project proved it.
Security wanted a list of staff vehicle plates for gated access.
I objected.
“Personal data.”
“Yes.”
“Do we need all of it?”
“For employees who drive through the gate, yes.”
Could use temporary permits?
Maybe.
But permanent staff parking made plate registration reasonable.
So:
Purpose.
Access.
Retention.
Deletion after employment.
Not:
No data.
Then another project.
Event planners wanted family emergency contacts “just in case.”
No.
Security already had emergency contacts.
Event planners did not need copies.
Different.
Judgment.
Then premium-shift scheduling became part of data governance because managers were using guest-rating notes.
Some notes were useful:
Speaks Italian.
Experienced with silver service.
Some were inappropriate:
Pretty.
Too quiet.
Difficult.
Looks tired.
We removed personality gossip.
Kept job-relevant skills and documented performance.
Then one note:
“Single mother, may cancel.”
Illegal-looking bias risk.
Removed.
Manager coached.
Then I realized personnel systems can become prejudice archives if nobody asks why a field exists.
That lesson was bigger than the warehouse.
Then Caleb turned thirteen and became impossible.
Normal.
He wanted privacy from me.
Locked phone.
Closed bedroom door.
I hated it.
Then remembered my job.
Access is not consent.
Even guardians need boundaries appropriate to age.
Not absolute.
But growing.
He said:
“You tell rich people not to snoop. Stop reading over my shoulder.”
Fair.
Then Roman and Maya had no children yet. Fine.
Their personal life stayed separate.
Then one current fraud report tested our systems.
A payroll employee noticed two direct-deposit changes within an hour for the same worker.
Flag.
Could be fraud.
Could be employee correction.
Payroll contacted worker through existing verified channel.
One change unauthorized.
Account blocked before payment.
No police drama.
The employee had clicked a phishing email.
The control worked.
Then security wanted mandatory biometric login for payroll employees.
IT recommended hardware keys instead.
Less sensitive.
Adopted.
No need to collect more bodies to protect body data.
Then the estate created a recovery fund for identity incidents.
Not hush money.
Pre-approved coverage for credit freezes, replacement IDs, legal consultations, and documented lost time if a breach involved employer systems.
Why?
Response should not depend on whether Roman personally felt generous.
Institutionalize.
Then one employee used it after a vendor email breach exposed tax forms.
No scandal.
Support activated in hours.
That mattered.
Then my management skills improved slowly.
I supervised two analysts.
One was brilliant and chronically late.
I avoided addressing it because his work was good.
Team resented.
Eventually Elise said:
“Clarity delayed becomes favoritism.”
So I addressed.
Documented expectations.
Flexible start time where possible.
Core meeting hours.
Performance improved.
Then another analyst was always early and volunteered everything.
I praised her constantly.
She burned out.
I had recreated the “always available” trap.
We changed.
Workload limits.
Comp time.
No praise for self-erasure.
Then one analyst asked if overtime refusal would hurt promotion.
“No.”
“How do I know?”
Good question.
We published promotion criteria.
Projects.
Skills.
Judgment.
Collaboration.
Not availability outside agreed hours.
Then six months later she declined overtime twice and still got promoted after strong work.
Visible proof.
Then the warehouse company—now Harborline Logistics—bid on a furniture-moving contract.
Could they?
Yes.
New ownership.
Clean audits.
No personnel data.
They won.
I felt sick when I saw the address.
Same warehouse.
I recused myself from scoring.
Why?
Not because I had a legal conflict.
Because my personal history could affect judgment.
Another manager scored.
Harborline won legitimately.
Then first delivery from that warehouse arrived.
I did not go outside.
Next one, I did.
Driver I had never seen.
Truck blue.
Not black SUV.
Furniture normal.
The world had reused the building without asking me.
That was probably healthy.
Then Harborline invited operations staff for a vendor tour.
I declined.
No career penalty.
No need to prove recovery by walking into the exact room.
Elise went.
Reported strong controls.
Contract continued.
Choice.
That mattered.
Then Roman asked once:
“Do you want us never to use that building?”
“No.”
“You’re sure?”
“Yes.”
Then:
“I just don’t want to go there.”
He nodded.
Perfect.
Protection without forcing the world to freeze around my pain.
The Harborline decision also led us to create recusal guidelines.
Personal history is not automatically a legal conflict.
Still, decision quality matters.
A manager can say:
“I can provide facts, but I should not score this vendor.”
Then another reviewer handles.
No shame.
Later, Marcus recused from a vendor because his sister worked there.
Actual relationship.
I recused from Harborline because of trauma history.
Different reasons.
Same tool.
Then one procurement manager tried to recuse from every difficult decision.
That was not the purpose.
Recusal needs a reason tied to impartiality or conflict.
Otherwise managers still have to manage.
Then a security vendor proposed referencing my warehouse case in sales materials as proof the estate had “transformed.”
No.
We refused use of employee incident details.
They could describe controls generically.
My kidnapping was not a marketing asset.
Then another vendor asked me to speak at a privacy conference.
I agreed once.
Not about the warehouse scene.
About employee identity data in vendor ecosystems.
No photos.
No names.
No Roman.
No Evelyn.
The audience cared about retention schedules more than drama.
That felt strangely satisfying.
The lesson could travel without taking my whole story with it.
My first conference talk also taught me something about storytelling.
The moderator wanted me to open with the warehouse.
I said no.
I opened with a spreadsheet.
Columns:
Data type.
Purpose.
Vendor.
Retention.
Deletion evidence.
The audience looked disappointed for about thirty seconds.
Then they started taking notes.
Good.
People love dramatic origin stories.
Operational change survives through boring artifacts.
Then a compliance officer asked:
“How do you convince executives to care before something happens?”
I answered:
“Show them where unnecessary data creates cost, liability, and confusion now.”
Not:
Wait for a housemaid to bleed.
That was the point.
Then one attendee privately told me her company had dozens of former employees’ passport scans sitting in a shared folder.
She went home and fixed it.
Maybe.
I never knew.
That was enough reason to speak.
Then back at the estate, one analyst wanted to create a “Nora checklist” for vendor identity risk.
No.
We called it the Employee Identity Data Standard.
A rule should not need my name to have authority.
That mattered more every year.
The vendor-recusal policy later protected me in a different way.
A consulting firm bidding on a data project hired Evelyn Sterling as a subcontractor for event-sector expertise.
I learned during disclosure.
Could the firm still bid?
Maybe.
Did I need to be the one deciding?
No.
I recused.
Independent procurement reviewed.
The firm removed Evelyn from the proposed Calder work and kept her on unrelated clients.
Then competed.
They lost on price.
No blacklist.
No forced confrontation.
I never spoke to her.
That was exactly what a mature process should make possible.
Then one colleague asked if seeing her name bothered me.
“Yes.”
“Does that mean she should be banned forever?”
“No.”
Those answers could coexist.
Personal boundaries and institutional fairness do not have to be identical.
The conference experience also changed how I trained my own team.
I stopped opening every session with the worst-case story.
Instead we started with ordinary questions.
Why does this vendor need the field?
Who owns the data?
When does the need end?
What happens if the person leaves?
Then, only after the framework made sense, we showed one or two incidents that explained the stakes.
People retained more.
Fear gets attention.
Structure gets repeated.
That mattered because most of our job was repetition.
The training program also added one exercise about legitimate urgency.
A worker’s passport is needed for travel tomorrow.
That is urgent.
It does not mean email the passport to everyone who asks.
Use the approved travel channel.
A bank needs identity confirmation before payroll cutoff.
Urgent.
Still verify the request.
Urgency changes timing.
It should not erase process.
That distinction became especially useful in private households, where everything can feel urgent because the person asking is important.
Then one manager said:
“But sometimes Roman really does need something now.”
Of course.
The right system should support fast legitimate action.
Not force everyone into side doors.
We created expedited paths for genuine urgent needs.
Logged.
Scoped.
Review afterward.
Fast and controlled are not opposites.
The expedited process itself had limits.
Emergency did not mean undocumented.
After-action review happened the next business day.
If someone used the fast path repeatedly for foreseeable work, that was a planning problem.
One manager tried.
Three “emergencies” in one month.
All late vendor requests.
May you like
We stopped approving them as emergencies and fixed the planning calendar.
A shortcut should stay exceptional or it becomes the new shadow system.
