Who ultimately decides the patches cannot be added (for whatever reason)? It's ultimately the bean counters and managers beholden to them. So I'm not really go

Who ultimately decides the patches cannot be added (for whatever reason)? It's ultimately the bean counters and managers beholden to them. So I'm not really going to look down on the govt IT workers (or contractors).