Sure they can. Just build something that allows for abuse, set up controls that prevent individual employees from abusing it, then have an exec secretly do whatever they want without your involvement.