'Lock and block' device policies falling to lessons in self-management