Skill.re
Your Accountability As An It Professional
The Hook
You're an IT operations manager. You know ChatGPT exists. You know that 60% of your company uses it without approval. You've seen the traffic patterns in your network logs, heard it mentioned casually in meetings, and found references to it in incident reports. You recommended that the CIO establish an AI governance policy six months ago. It made the roadmap for next quarter. You filed a ticket. You documented the risk. You did your due diligence.
Three months later, your finance department experiences a security incident. Someone in accounts payable pasted vendor payment reconciliation data into ChatGPT to help organize it. The data included vendor names, payment amounts, bank account numbers, wire instructions, and historical contract terms. That data is now in OpenAI's infrastructure. It's in their training pipelines. It's potentially recoverable by threat actors. Your CEO discovers that payment data for 47 vendors, including those you haven't disclosed breaches to yet, is now outside the organization's control.
Your company initiates a forensic incident investigation. Your CISO is furious. Your CIO asks the room: "Why weren't we aware this was happening? Why wasn't it blocked? How did this get past IT?" You're sitting in that room. You knew this was happening. You knew the specific risk. You escalated it. The organizational response was to deprioritize it. But as an IT professional, you're still asking yourself: do I have accountability for security and compliance in my domain even when leadership chose not to act?
Now here's the uncomfortable truth: yes, you do. But that accountability has boundaries. This lesson teaches you where your personal accountability begins and ends in the AI era, what you're actually responsible for doing, and how to distinguish between the accountability you own and the decisions that belong to leadership.
Purpose: Understanding Your Accountability
As an IT professional, your accountability flows from the access, visibility, and decision-making authority you have. You might not be the CEO or the CIO, but you control which systems are deployed, how they're monitored, what gets escalated, and how resources are allocated. Those decisions have consequences. This lesson teaches you to understand which consequences are yours to own and which belong to leadership. It's not about claiming credit for success or avoiding blame for failure. It's about understanding where you have actual agency, where your responsibility lies, and how to operate effectively when organizational priorities don't align with technical risks.
The difference between a mature IT professional and a junior one isn't whether they face difficult governance decisions. It's whether they understand the boundaries of their accountability and make decisions based on professional judgment rather than either overbearing control or defensive avoidance.
Why This Matters for IT Professionals
Shadow AI governance will be one of the defining challenges of your career over the next 5-10 years. Every CIO you'll work with will struggle with it. Every compliance audit you undergo will have questions about it. Every breach investigation will ask why you didn't have it under control. If you don't understand where your accountability lies, you'll either take on too much responsibility (burning out trying to control behavior you can't control) or too little (becoming a liability when things go wrong). Understanding your boundaries is how you become the kind of IT professional that organizations trust and depend on.
Core Concepts: Your Four Core Responsibilities
Know Your Organization's AI Policies and Governance Structure
This might sound obvious, but it's where accountability starts. Your first responsibility is understanding what governance exists and who owns it. You need to know:
- What is your organization's official policy on generative AI tool use?
- Are there approved tools? What are they? What data can they process?
- Are there prohibited tools? Which ones? Why are they prohibited?
- What data classifications can be used with which tools?
- What's the approval process for new AI tools?
- Who owns AI governance (compliance, security, IT, business)?
- How is AI governance funded and prioritized?
- What are the audit and documentation requirements?
- What's the consequence for policy violation?
- How is policy communicated to employees?
Key insight: If your organization doesn't have an AI policy, your responsibility is different: you need to escalate the need for one to your leadership and advocate for its creation. You can't govern what you don't have a policy for. Not having a policy isn't an excuse for inaction. It's an action item that needs to be addressed immediately. Many IT professionals make the mistake of treating absent policy as "not my responsibility." It is. Escalating the need for policy is your responsibility.
If your organization does have a policy, you need to understand it deeply enough to make decisions about its enforcement, identify when it's being violated, know how to respond when violations occur, and understand its compliance implications. You're not expected to be the policy, but you're expected to understand it well enough to execute it.
This is foundational accountability. If you can't answer these questions, your first action is to find out the answers.
Report Shadow AI When You Discover It with Professional Judgment
Shadow AI governance isn't IT's sole responsibility. But IT is usually the team positioned to detect it first. You see network traffic patterns, you review tool usage reports, you respond to security incidents, you audit systems, you conduct vulnerability assessments. You have visibility.
When you discover shadow AI usage, you have a responsibility to report it. This doesn't mean you personally police every ChatGPT login. It means you apply professional judgment about whether what you've discovered is worth escalating.
Key insight: There's a critical difference between detecting shadow AI and having accountability for every instance of it. If you discover through a security incident that sensitive data was exposed via an unapproved AI tool, you report it. You don't keep it quiet. You escalate to security leadership and compliance. But if you see that a single developer used ChatGPT once for 10 minutes to help with syntax, that's different. It's less critical. Professional judgment means distinguishing between these.
Examples of what you should report:
Critical escalations: You're responding to a security incident and discover sensitive data was exposed via an unapproved AI tool. You're monitoring tool usage and see patterns suggesting widespread unapproved AI use in regulated processes. You're responding to a compliance audit and discover employees have been using unapproved AI tools in processes that require control. You discover an employee pasting customer PII into consumer AI tools.
Documentation and tracking: You see tools being used that aren't approved, but you recognize the risk is manageable. You document the usage, track the pattern, and recommend policy response rather than emergency escalation.
Not actionable: A single user mentions trying ChatGPT once for a non-sensitive task. This doesn't require escalation; it requires education.
You report to create visibility and initiate a governance response, not to punish employees or create a surveillance culture. Understanding this distinction is essential to your credibility.
Model the Behavior You Expect from Others
This is the hardest core responsibility because it requires you to manage your own behavior carefully and intentionally.
As an IT professional, you have access to more sensitive information than most employees. You see customer databases, employee records, financial data, security configurations, infrastructure details, password hashes, API keys. You're trusted with information that could cause significant harm if exposed.
Key insight: When you use an unapproved AI tool, you're making a conscious decision about that trust. Every time an IT administrator pastes a system configuration into ChatGPT to get help troubleshooting, they're exporting that configuration outside the organization's control and into OpenAI's infrastructure. Every time an IT auditor uses Claude to help prepare audit documentation, they're potentially exposing audit findings to a third party. Every time an IT manager uses Copilot to draft a performance review, they're potentially sharing confidential employee information.
This isn't just about rule-breaking. It's about modeling professional judgment and the standards you expect from others. If IT professionals are careless with sensitive data while using AI, how can you credibly expect other employees to be careful? Your personal AI tool usage sets the standard for your organization. If you're careful, intentional, and compliant, others will see that as the expectation. If you're casual and rule-breaking, others will see that as permission.
You have more responsibility to be exemplary, not less. Not because of your job title, but because of your access and knowledge.
Escalate and Advocate for Better Governance When Policies Are Broken
If your organization's AI policy is inadequate, or if the approval process is too slow, or if employees don't have legitimate ways to use AI tools, you have a responsibility to advocate for change and improvement.
Key insight: Advocating for change is not complaining to colleagues or venting about how broken things are. It's structured, evidence-based advocacy directed at decision-makers. This includes:
Making a business case to leadership: "Our policy requires AI approval, but the approval process takes 6 months. This creates a tool availability gap that drives shadow AI. I've documented that 60% of the company is already using ChatGPT. Here's how we can fix it. Here's the cost. Here's the timeline. Here's why it matters."
Recommending specific tools and compliance mechanisms: "We should approve Claude for tasks where data doesn't leave our organization, but not for PII processing. Here's how we would set up access controls and audit logging. Here's the compliance assessment."
Proposing alternative governance models: "Instead of banning all unapproved tools, we could create a whitelist of approved tools and require training on data handling for each one. This would reduce shadow AI while maintaining security."
If you don't advocate, you're accepting a status quo that you know is broken. That's less defensible than actively trying to fix it. And from an accountability perspective, if you've identified governance gaps and done nothing, you can't claim you weren't aware when a breach happens.
This is different from responsibility for the outcome. Leadership gets to decide whether to implement your recommendations. But you're responsible for making sure they understand the problem and the options.
Responsibility Two: Report Shadow AI When You Discover It
Shadow AI governance isn't IT's sole responsibility. But IT is usually the team that's positioned to detect it first. You see network traffic patterns, you review tool usage reports, you respond to security incidents, you audit systems, you conduct vulnerability assessments.
When you discover shadow AI usage, you have a responsibility to report it. This doesn't mean you personally police every ChatGPT login. It means:
If you discover through a security incident that sensitive data was exposed via an unapproved AI tool, you report it to security leadership and compliance. You don't keep it quiet. You don't hope nobody notices. You escalate.
If you're monitoring tool usage and see patterns that suggest widespread unapproved AI use, you report it to your IT leadership and recommend a response. You quantify the exposure. You document what you found.
If you're responding to a compliance audit and you discover that employees have been using unapproved AI tools in regulated processes, you disclose it and help remediate. You don't hide it. You don't hope the auditors don't ask about it.
You don't report to punish employees. You report to create visibility and initiate a governance response. There's a difference between "I discovered someone used ChatGPT for 10 minutes" and "I discovered a pattern of shadow AI use that creates compliance risk."
Responsibility Three: Don't Use AI Carelessly Yourself
This is the hardest part because it requires you to model the behavior you expect from others.
As an IT professional, you have access to more sensitive information than most employees. You see customer databases, employee records, financial data, security configurations, infrastructure details. You're trusted with this information.
When you use an unapproved AI tool, you're making a decision about that trust. Every time an IT administrator pastes a system configuration into ChatGPT to get help troubleshooting, they're exporting that configuration outside the organization. Every time an IT auditor uses Claude to help prepare audit documentation, they're potentially exposing audit findings. Every time an IT manager uses Copilot to draft a performance review, they're potentially sharing confidential employee information.
This isn't just about rule-breaking. It's about modeling professional judgment. If IT professionals are careless with sensitive data while using AI, how can you expect other employees to be careful?
Your personal AI tool usage sets the standard for your organization. If you're careful, intentional, and compliant, others will see that as the expectation. If you're casual and rule-breaking, others will see that as permission.
You have more responsibility to be exemplary, not less. Not because of your job title, but because of your access and knowledge.
Responsibility Four: Escalate and Advocate for Better Governance
If your organization's AI policy is inadequate, or if the approval process is too slow, or if employees don't have legitimate ways to use AI tools, you have a responsibility to advocate for change.
This doesn't mean complaining to your colleagues. It means:
Making a business case to leadership: "Our policy requires AI approval, but the approval process takes 6 months. This creates a tool availability gap that drives shadow AI. Here's how we can fix it. Here's the cost. Here's the timeline. Here's why it matters."
Recommending specific tools and compliance mechanisms: "We should approve Claude for tasks where data doesn't leave our organization, but not for PII processing. Here's how we would set up access controls. Here's the compliance assessment."
Proposing alternative governance models: "Instead of banning all unapproved tools, we could create a whitelist of approved tools and require training on data handling for each one."
If you don't advocate, then you're accepting a status quo that you know is broken. That's less defensible than actively trying to fix it.
Where Your Accountability Ends: The Boundaries
Understanding where your accountability ends prevents you from taking on responsibility for things outside your control and burning out trying to control the uncontrollable. These boundaries are where professional accountability becomes realistic and sustainable.
You're Not Responsible for Employee Behavior Outside Your Control
If an employee uses ChatGPT at home on their personal device with their personal account, and they deliberately violate your policy, that's their decision and their accountability. You have no visibility into that behavior. You have no technical controls. You can't reasonably prevent it without surveillance measures that most organizations and employees would rightfully reject.
You're responsible for creating a clear policy and communicating it effectively. You're responsible for making the approved tools good enough and easy enough that employees want to use them instead of workarounds. You're responsible for helping employees understand why the policy exists and what the risks are. You're not responsible for monitoring every personal device, every network connection, or every home WiFi. The moment you try to do that, you've crossed into surveillance territory that erodes employee trust and violates privacy norms.
There are limits to what you can control, and part of professional accountability is understanding and respecting those limits. Trying to exceed these boundaries makes you less effective, not more.
You're Not Responsible for Leadership Decisions You Don't Control
If your CIO prioritizes other work over AI governance, that's a leadership decision, not an IT operations failure. You can recommend policy changes. You can escalate risks. You can provide data about the scope and impact of shadow AI. You can propose solutions and business cases. But the final decision belongs to leadership, not IT.
Your accountability is in making sure leadership understands the risk, has the information they need to decide, and has heard your recommendations clearly. It's not in forcing a decision that leadership doesn't prioritize or taking responsibility for their choices. If you've escalated appropriately and documented your recommendations, you've fulfilled your accountability.
This distinction matters in post-incident investigations. When a breach happens and leadership asks "why didn't you prevent this," you can point to the escalation you made, the risks you documented, and the recommendations you proposed. You can't guarantee prevention, but you can guarantee that leadership was informed.
You're Not Responsible for Third-Party Vendor Behavior Changes
If you approve Claude for use in your organization, and Anthropic changes their data retention policy in ways that conflict with your requirements, that's not your fault. You can't control vendor decisions.
You are responsible for vetting vendors carefully before approval. You are responsible for reviewing their current policies, terms of service, and compliance agreements. You are responsible for understanding their data handling practices. You are responsible for having a process to stay informed about vendor changes and having the ability to revoke approval if a vendor becomes unacceptable. You are responsible for including change notification requirements in your contracts. But you're not responsible for changes that happen after you've done due diligence.
Your accountability is in having robust vendor management practices, not in predicting future vendor behavior.
You're Not Responsible for Every Possible Misuse of Approved Tools
You can create reasonable controls and education and still have someone deliberately violate policy. An employee might paste customer data into an approved AI tool despite training, policy, clear guidance on what data is sensitive, and consequences for violation. That's their decision and their accountability.
Your accountability is in creating reasonable controls that make compliance the path of least resistance, educating employees about why the policy exists, documenting your governance process for audits, and responding appropriately when violations are discovered. You can't guarantee that nobody will ever violate policy. Perfect compliance is not achievable, and pursuing it will distract you from more important governance challenges.
Practical Use Cases: Accountability in Action
Use Case 1: Discovering Shadow AI in a Regulated Process
You're monitoring network traffic and discover that your compliance team is using ChatGPT to help organize audit findings. This is a significant concern because audit findings are confidential and potentially sensitive.
Without professional accountability: You either report it as a critical security incident (escalating alert fatigue) or you ignore it entirely (failing to address regulated process risk).
With professional judgment: You investigate first. You understand what specific data has been exposed, which compliance frameworks are affected, whether this is an ongoing pattern or a one-time incident. You determine that three people in compliance have used ChatGPT with audit data over the past two months. You document the findings. You escalate to the Chief Compliance Officer and your security team with specific details, not vague concerns. You recommend a short-term remediation (policy reminder) and a longer-term solution (approved alternatives). You time the escalation appropriately and document your decision-making.
Time savings: 2 hours investigation, documentation, and escalation. Prevents both over-escalation and under-escalation.
Use Case 2: Evaluating an Unapproved Tool Request
A department asks IT to approve a new AI tool for content creation. The request comes with a business case showing productivity improvements. But you haven't evaluated the tool's security posture or compliance implications.
Without accountability: You either block it immediately (creating shadow adoption) or you approve it without assessment (creating compliance risk).
With professional judgment: You request security documentation from the vendor. You assess what data will be processed by the tool. You map that data to compliance frameworks that apply to your organization. You get security review and compliance review completed (even if it's fast-track). You document assumptions and limitations. You approve with guardrails (specific data types allowed, audit logging required, quarterly review).
Time savings: Structured evaluation prevents later rework and security incidents.
Anti-Patterns in Accountability Management
Risk: Treating All Shadow AI as an Emergency
Why it happens: Fear that you'll be blamed if something goes wrong, so you escalate everything.
What goes wrong: Alert fatigue makes people ignore real escalations. Your credibility as a professional decision-maker erodes.
How to avoid: Apply professional judgment. Distinguish between critical risk (immediate escalation), serious policy violations (documented and escalated), and isolated incidents (documented and communicated).
Risk: Avoiding All Accountability by Claiming You Have "No Control"
Why it happens: Frustration that leadership won't prioritize AI governance, so you decide it's "not your problem."
What goes wrong: You discover shadow AI and don't escalate it. A breach happens. You're blamed because you had visibility but chose not to act.
How to avoid: Understand that "I don't have control" is different from "I have no responsibility." You can't control all behavior, but you can control your own actions and decisions.
Risk: Promising to Eliminate All Shadow AI
Why it happens: You want to be responsive to leadership concerns and promise to solve the problem completely.
What goes wrong: You can't deliver on the promise. You lose credibility. Shadow AI continues anyway.
How to avoid: Be honest about what you can and can't accomplish. "I can reduce shadow AI by 60-80% through policy and approved tools. Complete elimination requires monitoring that most organizations won't accept."
Risk: Making Governance Decisions Without Consulting Stakeholders
Why it happens: You want to be efficient and avoid lengthy approval processes.
What goes wrong: You approve a tool that creates compliance risk you didn't anticipate. You make a decision that affects another department without their input.
How to avoid: Governance decisions should involve compliance, security, and affected business leaders. That adds time upfront but prevents rework.
Examples of Accountability in Different Scenarios
Scenario 1: The Proactive IT Manager
An IT manager discovers that developers are using GitHub Copilot without approval. Traffic patterns show that Copilot is being used daily across the engineering team. She takes the following steps:
Gathers information: She researches Copilot's data handling practices, licensing model, security certifications, and compliance implications.
Assesses risk: She identifies that Copilot processes code and could potentially expose proprietary code or security credentials if developers aren't careful. But she also recognizes that Copilot is widely used in the industry and has legitimate productivity value.
Escalates appropriately: She reports the shadow AI usage to the CIO and security team. She quantifies the scope (100+ developers using it regularly). She doesn't frame it as a crisis, but as a governance gap that needs to be addressed.
Proposes solutions: She recommends either (a) approving Copilot with guardrails and training, or (b) deploying an approved alternative. She outlines the security requirements for either path.
Documents everything: She maintains records of her investigation, escalation, recommendations, and any leadership response.
Her accountability: She's met the professional judgment standard. She's done due diligence. She's escalated appropriately with data and recommendations. If the CIO decides not to act, that's a leadership decision. If a breach happens later because Copilot-generated code had vulnerabilities, she can point to her recommendation and ask why it wasn't implemented. She's shifted accountability to where it belongs while clearly documenting her own due diligence.
Scenario 2: The Negligent Administrator
Another IT administrator discovers the same Copilot usage in his organization. He:
- Thinks it's not his problem: "Developers are smart, they know what they're doing."
- Doesn't investigate: He hasn't looked into what data Copilot processes or how it handles code.
- Doesn't escalate: He mentions it casually to a colleague but doesn't formally report it.
- Doesn't advocate: He doesn't propose solutions or governance models.
- Continues with his day: Six months pass.
Then a developer uses Copilot to write payment processing code. The Copilot-generated code includes a hardcoded API key (a common vulnerability in AI-generated code). The code gets deployed to production. The API key is compromised. There's a breach affecting customer payment data.
The incident investigation asks: "How did this get into production? Didn't anyone review the code? Why wasn't there a process for reviewing AI-generated code?"
They discover that this administrator knew Copilot was being used and did nothing. Now he's accountable. Not because he built the vulnerability, but because he had visibility into a shadow AI risk, understood the potential impact, and chose not to escalate or propose governance solutions.
The difference: Both administrators would have spent roughly the same amount of effort (2-3 hours research, escalation, and recommendations). The difference is that one fulfilled professional accountability and one failed it. The failure wasn't in preventing the breach (you can't always do that), but in failing to escalate a known risk and propose solutions.
Scenario 3: The Overwhelmed Department Manager
A department head learns that their team is using ChatGPT for content creation without approval. They're worried about compliance but also worried about banning the tool and reducing team productivity (the team has tight deadlines). They come to IT asking: "What should we do?"
This is a case where IT's expertise should help. You should:
Assess the specific use case: What data is being processed? What framework apply? What's the actual compliance risk vs. perceived risk?
Understand the productivity need: Why are they using ChatGPT? What would it replace if we approved it? What alternative tools would meet the need?
Propose guardrails, not prohibition: "You can use approved tools for this type of work, with these restrictions on data handling."
Educate: Help the team understand what data is sensitive and why, and how to use tools safely.
Your accountability is in providing this expertise and guidance, not in dictating to the department what they can or can't do.
Accountability and Your Role as Both Gatekeeper and Enabler
This is the reframing that makes accountability manageable. As an IT professional, you have two roles, and they're equally important. They sometimes create tension, but both are necessary:
Gatekeeper: You understand the risk. You make sure tools that create serious compliance or security risk don't get deployed at scale without proper controls. You require compliance review before new tools go into production. You protect the organization from unnecessary exposure. You're the person who can say "no" when something is genuinely dangerous.
Enabler: You understand that employees have legitimate productivity needs for AI tools. You work to make approved tools available, easy to use, and compliant. You make the approval process transparent and timely. You enable innovation and productivity while managing risk. You're the person who helps things happen safely.
Your personal accountability is in doing both of these well. Not in perfectly preventing all shadow AI (impossible), but in creating an environment where responsible AI use is the path of least resistance.
Your Role as Both Gatekeeper and Enabler
This is the reframing that makes accountability manageable. As an IT professional, you have two roles, and they're equally important:
Gatekeeper: You understand the risk. You make sure unapproved tools that create serious risk don't get deployed at scale. You require compliance review before new tools go into production. You protect the organization from unnecessary exposure.
Enabler: You understand that employees have legitimate needs for AI tools. You work to make approved tools available, easy to use, and compliant. You make the approval process transparent and timely. You enable productivity while managing risk.
Your personal accountability is in doing both of these well. Not in perfectly preventing all shadow AI, but in creating an environment where responsible AI use is the path of least resistance.
Human Judgment Checkpoints
Where should you focus your accountability efforts? Use these checkpoints to assess where you stand:
Checkpoint 1: Do you understand your organization's AI governance structure?
Who owns AI decisions? What's the approval process? What policies exist? How is AI governance funded and prioritized? If you don't know the answers to these questions, that's your starting point. Schedule time with your CIO or compliance leader to get clarity. You can't be accountable for something you don't understand.
Checkpoint 2: Have you identified shadow AI in your organization?
You don't need to know about every instance, but you should know whether shadow AI is happening and at what scale. Is it 5% of employees using ChatGPT occasionally, or 60% using it daily in regulated processes? Is shadow AI happening in general business work, or in sensitive areas like compliance, finance, or healthcare? If you haven't assessed the scope, that's a gap you should fill.
Checkpoint 3: Have you escalated shadow AI appropriately?
If you found shadow AI creating compliance risk or affecting regulated processes, did you report it to the right people in a professional way? Did you quantify the risk and propose solutions, or did you just raise concerns without context? If you identified a significant governance gap but haven't escalated it formally, that's an accountability gap on your part.
Checkpoint 4: Are you modeling the behavior you expect from others?
Are you using AI tools appropriately and intentionally? Are you keeping sensitive data out of consumer AI tools? If you're a sysadmin pasting system configurations into ChatGPT to troubleshoot, you're sending a message that contradicts your policy. If you're an IT security officer using an unapproved AI tool to prepare audit documentation, you're failing to model the standard you're asking others to follow.
Checkpoint 5: Have you advocated for better governance?
If you found governance gaps (slow approval processes, inadequate policies, missing tools), did you propose solutions to leadership? Did you make a business case, or did you just identify problems? Identifying gaps is your responsibility. Proposing solutions is also your responsibility. Just complaining about broken governance is not fulfilling your accountability.
Checkpoint 6: Can you articulate where your accountability ends?
If a breach happens involving shadow AI, can you clearly explain what you did, what governance was in place, and what was outside your control? If your explanation is "I didn't know about it and nobody told me I needed to monitor for it," that's a gap. If your explanation is "I identified the risk, escalated it with specific recommendations, documented my findings, and leadership decided not to implement my recommendations," you've fulfilled your accountability.
Key Takeaways
Know your organization's AI policies and governance structure thoroughly. You cannot be accountable for something you don't understand. This is your starting point.
Report shadow AI when you discover it with professional judgment, distinguishing between critical risks and policy violations. Not every unauthorized tool use requires the same response. Critical risks get escalated immediately; patterns get documented and escalated appropriately; isolated incidents get tracked and communicated.
Model the behavior and standards you expect from others in your organization. If you use AI carelessly with sensitive data, others will follow that example. Your personal AI tool usage sets the standard.
Escalate and advocate for better governance when your organization's AI policies are inadequate or broken. You have responsibility to propose solutions, not just identify problems. Document your recommendations and the reasoning behind them.
Understand clearly where your accountability ends and where leadership's begins. You're responsible for creating governance frameworks and making sure leadership understands risks. You're not responsible for controlling every employee decision or preventing every possible misuse.
Your role is fundamentally both gatekeeper and enabler. You protect the organization from serious risks while enabling productivity and innovation. Both are essential. The tension between them is normal and healthy.
Apply professional judgment as your decision-making standard. You're expected to understand specific risks, assess context and impact, make reasoned decisions, and document your reasoning. Professional judgment is what distinguishes effective IT leaders from either control-obsessed administrators or abdicated leaders.