I am a manager in the cybersecurity division of the company I work in. I have been in management for about 5 years and am well respected by my colleagues.
This week, one of the cybersecurity engineers escalated to me a story about an angry / agitated internal customer who perceived he was not heard and whose request for elevated Domain Admin access was denied (rightfully). When I met with the internal customer, I said I understood his ask, but cannot grant him elevated access as such access is 1) Not needed for his use case and 2) against our security policy of least privileged access.
The internal customer began to become agitated and accusatory, saying security doesn't care, is trying to sabotage his job role, and decision to deny access was made arbitrarily. None of this was true as I showed him the policies, told him him he agreed to comply with IT security policies as a part of new hire conditions, and explained our reasoning for such rules. I remained professional / almost stoic with very little emotional display
However, as a protective step, I brought in my boss who is a director so this incident can be documented. He said I did the right thing and commended me on my poise shown in a stressful situation.
In an 1:1 today, I said to my manager how seeing an angry customer must have been upsetting and stressful and how I wished he did not have to see what he saw. I said I did not intend to stress him out and understood if he had any distress. No one wants to deal with yelling / unreasonable accusations so such feelings are understandable.
His reaction was rather confused and he told me that he felt what I said in 1:1 was a bit excessive / not needed.
Are my comments to my director excessive?
Is there anything I could have done more to shield him from having to experience such stress in the future, if our position was in the right as my boss confirmed?