All of a sudden the president doesn't want his Web access...

All of a sudden the president doesn't want his Web access filtered, so you remove the Web filtering only for him. Or some engineers want to FTP into a workstation. Next thing you know, you have different rules for different people.