That's kind of the issue with a lot of bureaucratic oversight. It often produces systems that aren't at all interested in being streamlined, in letting things that should happen happen. It produces systems where compliance is a drag on the one doing things, and the default state is "forbidden".