Failing that, complianceware should be restricted to running its non-Turing-complete rules locally rather than routing everything sensitive through one sweet sweet target host.

Authoritarian IT is always insisting everyone use cloud services -- but exactly the same cloud service for everyone. This seems designed to fail.