Of course every rule should have a limited scope. Institutions absolutely should not be allowed to have any say about what you do outside of their actual purview (ie: off of their property, not during work hours, while not representing them, etc).

Almost any way that Institutions have to detect rule breaking outside of their purview involves serious privacy breaches.