Or the company hosts a small NIP-46 bunker signing service and employees use that to publish. The bunker server can make sure nothing too horrible can be published against its will and enforce custom permissions and limits.