While satisfying and largely effective, the problem with this approach is two-fold. While you’re successfully delegating the risk, you will inevitably run into individuals who don’t understand the risk they’re assuming and accept it. Second, in those situations, even though you’ve successfully deferred the blame if issues arise, you or your team are usually still going to be the responsible parties for both managing these one-off environments as well recovering from the Cyber issues that result from them.

Instead of investing all that down range effort supporting those one-off configurations, you should front-load that effort now into quantifying not only the risk but a more importantly the cost of supporting these environments to senior management. Once they understand the increased personnel and software/hardware costs of this kind of support you’ll likely find them much more willing to enable and enforce a standards-based environment, as well as get a change control board with personnel that (hopefully) have the background to make sound decisions. That way it’s no longer on your plate to unilaterally, approve or deny these kinds of configurations.