Software vs Governance

In any application, there are often considerations about enforcing users to comply with certain behaviors. Salesforce provides some configurable mechanisms to enforce many needs (e.g. a salesperson cannot offer a discount over 10% without getting approval from a superior).

Other times, the desired use of the system can be very complicated and difficult to enforce. In some cases, no one knows how to articulate all the rules, they just know infractions when they see them.

Companies often assume that everything should be enforced through the software, though in some cases, it might be wiser and more economical to enforce rules through governance... essentially, telling users of the system what is expected of them. They are required use the system in a manner consistent with company rules regardless of what the system allows.

A more practical strategy might be to enforce the most egregious and costly abuses through the system, then enforce the remainder through simple governance.

Since most behavior is (or can be) tracked within Salesforce, one can see infractions, and who committed them by looking at auditing logs and simple data records. By default, Salesforce tracks who created each database record as well as who last modified it. With basic configuration, the system can track any number of things.