I agree with this, I think I was just interpreting "ban" differently. I.e. if the default is you can't use it, but then there is a specific request/review/audit process to allow it (as original GP's comment said), that makes sense. I just don't think it makes sense to ban without an exception process.