That sounds pretty irresponsible, I can't imagine serious orgs doing that without custom governance / approval software in place