I’ve been writing about corporate compliance for a long time, and like most executives who use Compliance Week, I’ve become comfortable using the abstract terms we all do when talking about the idea of “compliance.” But two incidents in the news recently remind me that for all our theoretical understanding of how compliance should work, we have to work within the confines of human nature—and ignore them at our peril.

Twice in the last month, workers at retail-oriented companies have foiled thieves trying to steal goods, and been fired for it. First, a teller at a Key Bank branch in Seattle chased a man who tried to rob the bank, and then held him in submission until police arrived. Several weeks later, a shop-lifter at a Best Buy in Broomfield, Colo., ran off with some electronics; two clerks ran after him and tackled him in the parking lot. All three men showed impressive bravery. They also violated company policy about handling thieves, and are now on the unemployment line.

This should be a compliance officer’s nightmare. If it isn’t—if you see those terminations as black-and-white decisions, easy to make—you’re not doing your job thoughtfully.

I understand the sentiment that companies should not reward this type of behavior. Spontaneous bravery can often be reckless, and recklessness gets people hurt or killed. At Best Buy, a manager rushed over to help his employees just as the shop-lifter pulled out a knife, and he took a slash to the arm. His injuries were minor, but he could have taken a stab wound to the chest rather than the arm. That bank robber could have opened fire in the building or the street. Companies have a compelling interest to prevent that, and to train employees to prevent it, and to punish them if they flout policy and encourage it.

Still … firing someone for bravery just doesn’t pass the smell test. When these news stories first broke, I quipped that I would have named those workers employee of the month and then suspended them without pay. The more I consider it, however, the more I believe something like that is the right idea. Companies do need to demonstrate that a casual disregard for policy, especially one that risks the lives of others, won’t go unpunished. But just as much, they should not send the message that bravery is an unpardonable sin, or that constant complacency is a quality they prize.

So often we talk in abstract terms about avoiding a “check the box” attitude toward compliance. Well, try telling employees you will take away their livelihood for tackling a thief, and see how long their enthusiasm lasts. People are cowardly and complacent all the time, but we want to be brave. When an company goes against that human nature, it sends the message that Corporate Headquarters isn’t the same as the real people in the workforce. And that’s how you lose them. That’s where the check-the-box attitude comes from.

I’ve already chatted with several compliance executives about these firings, and they are quick to note that these employees were trained in proper conduct during a robbery. The company expects a wiser, better reaction from its employees in high-pressure situations like that because it’s invested resources to help workers remember what they should do. I see the point, and as a consumer, I’m thankful that so many workers at so many stores do know what to do in these situations.

But to assume that worker + training = proper behavior is foolish. Workers aren’t numbers in a compliance monitoring program, who will always behave as expected once they certify that they’ve been trained for situation x. Most times they will, but occasionally someone will behave unpredictably in a high-pressure situation—not because he wants to, or plans to, but simply because he does. Any soldier who’s seen combat will tell you how indispensable training is, but he’ll also say that you never truly know how you’ll behave under live fire until you’re actually under live fire.

Occasionally workers will take the wrong action for the right reasons. It’s frustrating for compliance functions, yes—but enforcing a zero-tolerance policy against such behavior is the exact same thing, and that doesn’t help either.

Topics