The key point is this: the NSA does not create policy for its operations. Those are written into law through executive, legislative, and judicial processes, and the three should theoretically balance each other out, which the public currently deems as not doing a sufficient job of balancing. The NSA acts as an instrument -- the employees (to include the director) are directed through a system of reporting and feedback, and determine how best to act in order to obtain more positive feedback from customers of the reports.
This isn't some theoretical system I'm talking about -- it's a database of reporting with attached feedback. The feedback shows who consumed the report, whether or not the party found it useful, any enclosed comments about the report, and how high up the report went. If my report made it into the president's daily brief and more information about the reporting subject is desired, that will show up in the feedback, and thus I have my "direction".
How does this translate into real world operations? Here is a theoretical conversation between Mr. Policy and Mr. NSA:
-----------------------------------
Mr. NSA: Here is some information I found about country X, which might indicate that they're conducting operation Y.
Mr. Policy: I would like to learn more about operation Y, and country X's intentions to expand it.
Mr. NSA: I don't currently have the capability to expound upon operation Y, unless you grant me the authority to access datastore Z.
Mr. Policy: We took a vote, and you have access to datastore Z on a thirty day trial basis, but then must shut down operations if nothing of value is found.
Mr. NSA: Here is the information you requested about operation Y and country X's intentions.
Mr. Policy: This information was not useful in directing policy, therefore datastore Z is to no longer be accessed.
-----------------------------------
From this, I think you can extrapolate my point. Do you blame the scalpel for being too sharp, or the surgeon for handling it incorrectly?