When someone just does whatever they feel like and violates policy, what do you think should happen?

Should someone send them a sternly worded email for them to ignore?

Or maybe they should be allowed to do whatever they want regardless of what risk it poses to the organization?