To me this is extremely similar to change control requirements on systems - yes there is a very good reason for them, but if in practice the people administering these rules lose track of <i>why</i> the rules exist, have a lack of understanding of the technology involved (therefore unable to properly judge risk), and then throw some political chicanery where some people are eager for any new tool they can use to &quot;enforce their authoritah&quot; on those below them in the organizational chain, and you end up with an environment where doing things takes twice as long, but you&#x27;re not actually any safer than you were without the controls.