A widely-shared report this year carried an alarming headline: "Half your workforce is ignoring internal AI policies." The data is real and worth taking seriously — in a survey of 155 professionals, roughly 1 in 3 connected AI to their work email, 1 in 5 to internal databases, 1 in 10 shared API keys or developer credentials with AI tools, and 28% were using AI that takes autonomous actions rather than just generating suggestions.
But the framing is wrong. Employees aren't defying policy out of carelessness — they're routing around an operating model that hasn't caught up to how they already work. With the Model Context Protocol scaling from ~100 servers at its late-2024 launch to over 16,000, the surface area is exploding. The answer isn't stricter memos; it's an operating model that meets the work where it is and makes the governed path the easy path.