1. A method comprising: generating, at a policy server, a policy based upon a rule, wherein the policy defines electronic activity allowed at a device, and wherein the rule comprises a variable and a value specified for the variable; storing, by the policy server, the policy at a policy repository in communication with the policy server; receiving, by the policy server, a further rule from a third party device, the further rule comprising a further value; determining, by the policy server, that third party rule submissions are enabled; validating, by the policy server, the further rule to determine that the further rule is legitimate; updating, by the policy server, the policy based upon the further rule to obtain an updated policy; and storing, by the policy server, the updated policy at the policy repository.