Ah, assurance of compliance (pinky swear promises) over usability.

I once had to use a windows laptop that had to be stored in a safe when I wasn't using it, could only use it in a room that was keyed entry (also where the safe was). But the firewall config was practically wide open, and it had direct access to the internet. I couldn't even change it to be more secure. Ended up not connecting it to a network at all and just sneakernetting a thumb drive around so I wouldn't risk catching blame if something got out.

Edit: Yes, a thumb drive. That wasn't blocked either on this "hardened" system.