TBF there are orgs at companies whose sole role is to play DEFENSE - lawyers, CSO etc… if they deem something too risky it IS their job to block it, and then it’s up to upper management to override them if the situation calls for it.
Now that said they should still try to advance the mission within that framework, and not be lazy.
Now that said they should still try to advance the mission within that framework, and not be lazy.