Overemployment is not always fraud — but it creates predictable delivery and security risk 

This is a clarity problem, not a monitoring problem 

Overemployment sits on a spectrum. At one end, a contractor takes on undisclosed secondary work that quietly divides their attention. At the other, a worker bills full time at two employers at once. The common thread is not the second job — it is the non-disclosure. The organization made a capacity decision based on information that was never accurate. 

That distinction matters, because it points to the fix. The instinct is to monitor — to track logins, watch keystroke activity, audit hours. But surveillance is expensive, corrosive to trust, and easy to defeat. It treats a clarity failure as a policing problem. 

The organizations that handle this well do something simpler. They make capacity expectations explicit before the engagement starts: what the role requires, what disclosure is expected, and what counts as a conflict. When the expectation is clear, the ambiguity that overemployment depends on disappears.

Where the risk concentrates  

Not every role carries the same exposure. The risk is highest where divided attention does the most damage: 

• Roles with access to sensitive systems, source code, or client data, where a distracted worker is also a security exposure.
• Senior roles priced for judgment and presence, not just output — where the cost is the capacity that never shows up.
• Time-critical delivery roles, where availability during incidents is part of what was purchased.
• Roles where AI-assisted output can mask reduced engagement, making a capacity gap invisible against pre-AI expectations.

The last point is the one most programs miss. A capable worker using AI can deliver acceptable output in a fraction of the billed hours — which means the quality signal that would normally flag reduced engagement may never appear. The gap is real even when the work looks fine.

Start here 

Decide, before the role opens, what disclosure you require and what you consider a conflict. Put it in the engagement terms, not in a monitoring tool deployed after the fact. 

Then calibrate by risk. A short-term, low-access role does not need the same scrutiny as a senior engineer with production access. Define the small number of roles where divided capacity is a genuine security or delivery risk, and set clear expectations there first.

Questions to take back to your team

Which of our roles would be materially damaged by a contractor working a second undisclosed engagement? Do our engagement terms state our disclosure expectations explicitly — or do we assume them? Where would divided attention show up as a security exposure, not just a delivery one?