For my non-profit IT gig, management supports everything the other admin and I do. If it is in the policy it gets enforced. If it isn't then the "CEO" has to approve it. No exceptions except for emergencies (like actual emergencies not "I need this font downloaded using FTP" kinda emergency).
For my regular day job, the other admin and I are our management. It is easy for us to look across the desk and change policy. We have no written policy specifically for IT but do have rules concerning data storage (which is a lot of our job). We report to non-technical supervisors who don't care what we do as long as we don't break things (because damages can be costly).--
"I have measured out my life with coffee spoons..." - T.S Eliot
"I have often regretted my speech, never my silence." - Publilius Syrus
Ma blog: »www.johndball.com