In a strict security environment, shouldn’t the employee request permission or, at the very least, give IT a heads up that they’re going to sign up for an exter

In a strict security environment, shouldn’t the employee request permission or, at the very least, give IT a heads up that they’re going to sign up for an external service? IT would vet the service and then apply the domains to the whitelist. I know how bad it sucks to have to ask permission for every little thing, but if the alternative means risking ransomware attacks, then the case should be laid out transparently to everyone in the org so they understand why the rule is in place.