[throwaway86442]

It's more the severity and granularity at which they did this. It's definitely done by most enterprise IT orgs and there's good reason for it. Then there's what Disney does which blows past any level of reasonable.

Think: getting approvals for upsizing an AWS instance in accordance with AWS's recommendations on an instance class you're already using in an account already serving production. Adding a user to a per user billed SASS that's critical to the org (we had to seek approvals to add employees to Slack/Github/email, and they frequently got denied).

They will spend thousands of dollars in man hours to make sure you're not misusing a penny.