1. A method comprising: generating, at a policy server, a policy based on a rule that is obtained from a manager device, wherein the policy defines electronic activity that is allowed at a managed device, and wherein the rule comprises a variable and a value specified for the variable; receiving, by the policy server, a further rule from a third party device, the further rule comprising a further value, wherein the third party device does not comprise the managed device, and wherein the third party device does not comprise the manager device; determining, by the policy server, if third party rule submissions are enabled; and in response to determining that the third party rule submissions are enabled, determining, by the policy server, if the further rule is legitimate, and in response to determining that the further rule is legitimate, updating, by the policy server, the policy based on the further rule to obtain an updated policy.