You might be disappointed to know that native applications need pre-approval in most cases. There's a whitelist.

Of course, after years and years and hundreds of thousands of engineers, the whitelist is pretty robust.

I don't know for sure, but I bet Zoom has been on that whitelist, and "banning" is removing it from that whitelist.

I'll be absolutely stunned if people are really having to raise JIRA tickets instead of typing "brew install" but my information is secondhand so what do I know.

Our laptops are configuration managed, force upgraded, and surveilled, but we all have root and IT has never stood in the way of "power user" behavior. The extent of the frustration in engineering is that their management processes sometimes eat CPU. My understanding is that most of the Valley is like this.

https://github.com/google/santa is used to whitelist binaries on Macs, but you can fill out a form to instantly opt out. One of the options for why is "I use a package manager".

Most Google engineers don't have root on their own machines anymore.

That's not true; you can use "sudo" to get root access on gLinux desktops and servers.