If some security policy is only required for compliance and the security team agrees, the security team should do the bare minimum and look the other way smilin

If some security policy is only required for compliance and the security team agrees, the security team should do the bare minimum and look the other way smiling when the users circumvent that policy. Same with a good legal team.