That's unfortunately true too. I often break IT policies because I have to do my job and when I ask they don't have an answer. Security people definitely can't just say "No" but have to help finding a solution.