There's a big difference between "not authorised" (the current reality) and "disempowered". You are not authorised to send emails that place the company in lega

There's a big difference between "not authorised" (the current reality) and "disempowered". You are not authorised to send emails that place the company in legal jeopardy. You are disempowered from doing so if every email that you send has to be reviewed by a company officer first. The norm today is that you are trusted to not exceed the limits of your authority. How about every line of code that you write being reviewed by legal to make sure it was within the bounds of the law? There's plenty of scope here for a far more defensive position on ensuring compliance. That is what you would expect and desire from any attempt to massively increase the liability of errors, no?