That was my experience too. Legal wanted things locked down hard. IT was more than happy to make things easier for users as long as legal wasn't getting in the way. Usually meant the systems were simpler too if we had fewer rules and controls to enforce.