In a work business context, the company provides and owns the devices, and for security it needs to monitor not individual person behavior but threat indication and traceability. Network traffic should be routed through a company router to restrict and monitor which device and account talks to which systems and services and to monitor indications of breach.

The logging data must not be endlessly persistend for space usage reduction, data minimization, and eventual privacy. There must not be direct unauthorized access but access must be restricted and reasons must be documented.

When the devices are company owned and the usage announced to shall be only company activities not private activities, the privacy implications are low. If individuals specific behaviors are not monitored but only their broader activities across edges with security relevance and if that information is not accessed without reason, then it’s not a significant private issue but on the other hand remains security relevant anyway.

DNS and network filtering makes sense from a security perspective. If the company can assume only work related tasks are being done they can make reasonable guesses which services or countries will be accessed or internal services may be accessed from.

---

Parental controls make sense and change with age, parental education, and personality and trustworthiness.

I’m not sure how useful monitoring would be beyond basic indications.

---

What I would like to have for my own system; I would like to control and monitor which programs can see, read or write which files, services, and network targets. I do use some stuff in that area, but I would like a more obvious, convenient, and secure framework/suite. To protect myself from bad programs (which may not be “bad” initially and for a while). Zero trust means apps should run in minimum environments and access, not inherit the whole user session context and user accessible storage.