They should separate physical location from policy identity. The control should follow the user when consistency matters, and follow the location only when regulatory or operational conditions genuinely require it. The key is to make the mapping explicit, reviewable, and stable enough to support audit evidence and predictable enforcement.
Why site-based policy works best when it is attached to the right thing
Hybrid work policies fail when “site-based” is treated as a proxy for trust rather than a narrow control condition. The design question is whether the policy should follow the person, the device, or the physical site, and those are not interchangeable. A good policy model makes the trigger explicit so enforcement is predictable, auditable, and defensible during review.
The practical default is to anchor policy to the user or role when the business need is consistent access, then use location as an additional condition only when the site itself changes the risk or the legal requirement. That keeps the control model stable across home, office, and travel, while still allowing truly location-bound restrictions for sensitive networks, regulated facilities, or local operational constraints.
For teams that need a structured way to reason about trust boundaries, the same design logic shows up in the Threat Modelling Guide: define the boundary first, then decide which policy decision belongs on which side of it. The policy should describe the condition, the decision, and the evidence needed to prove the rule was applied the same way every time.
What makes location a valid policy input, and what does not
Location becomes a valid policy input when it materially changes the security or compliance posture. Examples include a regulated site with special handling rules, a constrained operational environment, or a legal requirement that access must be limited to a defined geography or facility. In those cases, the location is part of the control objective, not just a convenience signal.
What should not happen is using location as an informal shortcut for risk scoring or employee category. If two employees have the same job function and the same access needs, different office assignments alone should not produce different baseline permissions. That creates hidden exceptions, makes troubleshooting harder, and turns policy drift into an operational norm.
In identity-heavy environments, this distinction is easiest to maintain when policy follows the identity lifecycle rather than the building. The Workforce Identity Security Guide is useful here because it reinforces the idea that access should be governed through identity, session, and recovery controls, then adjusted only when a site constraint is genuinely part of the access decision.
How to make site-based policies stable enough for audit and operations
A stable policy needs three things: a clear rule, a clear source of truth, and a clear exception path. If location matters, define exactly which attributes are consumed, who owns them, how often they are refreshed, and what happens when the signal is missing or contradictory. If the rule cannot be explained in one sentence, it is probably not operationally stable enough.
Auditability depends on consistency. Teams should be able to show why a decision was location-based, what evidence triggered it, and whether the same rule would produce the same result tomorrow. That means logging the policy input, the decision outcome, and any exception approval, rather than only logging the final access grant or denial.
For validation and rollout discipline, a controlled test approach helps prevent accidental overreach. The Breach and Attack Simulation (BAS) Guide is not about policy design itself, but it is useful for checking whether the surrounding enforcement path actually behaves the way the policy intends under realistic conditions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | Location-based policy decisions are access enforcement rules. |
| AC-6 — Least Privilege | Site policies should not expand access beyond what the role and condition require. | |
| Recommendation — Define and enforce access conditions consistently across users and sites. Restrict access to the minimum needed for the specific location condition. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication and Access Control | Hybrid site policies depend on clear identity-to-access mapping and controlled enforcement. |
| Recommendation — Map policy decisions to explicit identity and access rules. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Site-based access rules are an access control design issue requiring defined criteria and review. |
| Recommendation — Document location-triggered access rules and review them regularly. | ||
Practitioner Guidance
What to prioritise: Separate the policy decision from the physical site record. If the same rule is supposed to work across multiple locations, codify that explicitly and treat location as an exception trigger rather than the default identity of the policy.
What to verify: Confirm that every location-based rule has an owner, a business justification, a review cadence, and a loggable decision path. If you cannot explain why the site matters in business terms, the rule is probably compensating for an undocumented process gap.
Decision rule: If the policy is about consistent employee access, follow the person or role. If the policy is about a regulated place, a constrained network, or a local operational requirement, follow the location, but only for that specific condition and no broader than necessary.
Practitioner takeaway: Good hybrid-work policy design is not location-first or identity-first in the abstract, it is condition-first, with each trigger mapped to the narrowest control that can be audited and enforced predictably.