Your approved-tools list records what the company authorized, not what it runs. A local agent installed in ten minutes is not on it.
TL;DR: Every AI tool your team uses without asking is a vote on the official path: too slow, too rigid, or missing. Read the votes before you ban the tools: giving people a sanctioned tool cut personal-account use where blocking did not, and nobody measures how long it takes to say yes. Data leaves through free accounts, tools expensed on a card, and local agents. A local agent installs in ten minutes with full access to the laptop. Praise AI in speeches and punish its early adopters, and people learn to hide. Run an amnesty inventory, leadership first, and publish time-to-yes by requester level. Fix the cause with training and a sanctioned alternative, offered fast.
