By Yair Knijn · November 19, 2025

The director who blocked a too-broad category, triggered a productivity revolt, and disabled filtering entirely

He had the budget, the mandate, and a board slide that said "reduce risky browsing." So the Monday the agent rollout finished, he switched on the social-media and web-chat categories for the whole fleet in one move. No pilot, no exception path. By Wednesday recruiting could not reach LinkedIn, marketing could not schedule posts, and the support team's vendor ran a chat widget that now threw a block page mid-ticket. He turned filtering off entirely on Thursday, and the program never came back.

The categories were not the mistake. Treating a debatable, business-adjacent category like malware and pushing it to everyone with no observation first was. The technical part worked perfectly. The program died anyway, because the first thing the company felt was friction with no visible threat behind it.

The first category you block decides the program's fate

People judge a filtering program by the first block page they hit. Interrupt a malware download and nobody mourns it. Stop a salesperson from opening a customer's Instagram and you have told the whole company that security is the team that breaks their job. Which categories you enable, and in what order, is a political decision before it is a technical one. "Ban distractions" is the worst opening move: loud, sympathetic complainants and no security win to point at.

Start with the categories nobody argues with

Begin where there is no defensible reason to be on the other side. Enable malware, phishing, and command-and-control, plus signed threat feeds like URLhaus, OpenPhish, and PhishTank. Nobody files a ticket demanding their right to reach a known C2 domain. These blocks make the case that the program protects people rather than polices them, and they buy weeks of clean operation before you touch anything contestable.

• Week one: malware, phishing, C2, signed indicator feeds. Almost no false-positive debate.
• Later, by group: gambling, adult, then the genuinely contested ones like social media or generative-AI chat, each with a named owner and an exception route.

Monitor mode before enforce mode

Run every new category in log-only mode first. Watch what it would have blocked for a week or two, then read the list before a single user sees a block page. Schools and libraries filtering under CIPA have documented the same lesson for years: blunt category filters overblock legitimate educational and health content, and the fix is tighter scoping plus review, never a wider net. Monitor mode is how you find your own overblocking before it becomes a revolt. The recruiter on LinkedIn and the vendor chat widget would both have shown up as log lines, not as a Wednesday escalation.

Roll out per policy group, not with fleet-wide hammers

Fleet-wide enablement assumes every job browses the same way, which is never true. Recruiting lives on social platforms. Engineering pulls from sites that misclassify as forums or file-sharing. Finance carries its own risk tolerance. Stage categories per group instead: a strict profile on the corporate-standard group, a lighter one on sales or engineering, each owner signing off on what applies to their people. One category can be enforced for one group and monitor-only for another on the same day.

Read backlash as data, not as failure

A complaint is a misclassified site or a real business need telling you where the policy is wrong. The director who rolled everything back read the noise as proof the program was a mistake. It was proof the rollout was. Each ticket should drive an allow-list entry or a category change, with the date and decision recorded, because NIS2 and ISO 27001 surveillance audits reward a documented exception process far more than a block-count dashboard.

ClearScreen assigns categories per policy group, so you can run malware and phishing in enforce mode across the fleet while a contested category stays in monitor mode for the recruiting group until its owner signs off. Start the malicious-first profile from /features.