1. A method comprising: receiving, at a policy server, a first rule comprising a variable and a value specified for the variable; generating, at the policy server, a policy based upon the first rule, wherein the policy defines electronic activity allowed at a device; storing, by the policy server, the policy at a policy repository in communication with the policy server; receiving, by the policy server, a second rule from a third party device; determining, by the policy server, if third party rule submissions are enabled; in response to determining that the third party rule submissions are enabled, validating, by the policy server, the second rule to determine if the second rule is legitimate, updating, by the policy server, the policy based upon the second rule to obtain an updated policy, and storing, by the policy server, the updated policy at the policy repository; detecting, by the policy server, electronic activity associated with the device; identifying, by the policy server, a policy rule that relates to the electronic activity detected; and determining, by the policy server, if the policy rule allows the electronic activity detected.