I spent a couple years in HR (and only a couple, thank goodness...).
The best advice I can give is don't be overly specific in your HR policies. Too many times people try to write HR policies that cover each and every possible aspect of every situation. All you end up with is pages and pages of uselessly technical drivel that only serves to give someone a way to weasel out of something on leaglistic grounds ("...but the policiy didn't say anything about this!").
In other words, be specifically vague. Give the general outlines of the policy without delving too deeply into specifics. Write your policies to be more of a statement of intent that allows for you to judge situations based on the facts at hand rather than be hemmed into a corner with an overly specific (but uselessly counter-productive) existing policy.
For example:
Poor Policy (this policy actually exists!) - "Employees shall be at work by 8:00 AM. Employees may be as much as ten (10) minutes late if unavoidable delays are encountered. Employees later than ten (10) minutes must provide documentation as to the nature of the delay. Employees more than one (1) hour late may be subject to disciplinary action. Employees may opt to use available vacation or sick time in lieu of disciplinary action in this situation (minumum of one-half day increments). Employees who do not work within this policy may be required to meet with a supervisor."
Good Policy - "Business hours are 8:00 AM to 5:00 pm, Monday through Friday. Employees shall be available to perform their job duties during these times. Employees unable to adhere to this policy may be subject to disciplinary action, up to and including termination of employement."
The first policy is too wordy and contains enough loopholes to drive a Greyhound bus through. The second states the basic intent of the policy, but leaves the door wide open for management/owners to make decisions based on the merits of a given situation.
Don't forget the magic phrase "Employees unable to adhere to this policy may be subject to disciplinary action, up to and including termination of employement." With very few exceptions, every section of the employee handbook should end with this statement.
Oh, and always reserve the right of the owners/management to make a unique dicision. Something along the lines of:
"At any time this Guide to Employment may be revised. Revisions become effective upon employee notification. Furthermore, the Company reserves the unrestricted right to make merit-based decisions on specific situations, even if such decisions may appear to be contrary to the terms set forth in this Guide."
As for the firearms policy, I suggest you have a none-policy. In other words, something that addresses the issue from a "third-party" standpoint. Have a section in the handbook that says something to the effect of:
"Firearms in the Workplace
Employees found in violation of applicable local, state, or federal laws will be subject to disciplinary action up to and including termination of employment. Such situations will, if necessary, be reported to the appropriate law enforcement agency."
There. If they aren't doing anything illegal then everything is great and wonderful. If they do something illegal, fire their butt and turn them over to the police. You didn't say a single thing to encourage carrying, you just iterated that illegal behavior will not be tolerated. Ergo, legal concealed carry is fine.
Brad