No one signs off "cloud-only". There's no meeting where a company decides to stop thinking. The policy says cloud-first, escape clause built in, and then the escape clause quietly stops being used. Not by decision. By drift.
Watch how it happens and it is almost never about technology. It is about who has to write the justification. Putting a workload anywhere other than cloud needs a written case for going against the strategy. Putting it in cloud needs nobody's permission. Faced with that asymmetry, a rational engineer picks the path that doesn't have to be defended, and the default hardens into a rule without anyone choosing it.
The reinforcements stack up, and none of them is a decision either. Procurement templates assume cloud. An auditor prefers one consistent answer to "it depends". The person who used to make the on-prem case moved teams, and nobody inherited the argument. Each one just makes the exception a little more expensive to reach for, until reaching for it looks like troublemaking.
So the workloads that never fitted go to cloud anyway, and the bill turns up later, itemised as premium rates on steady systems that never needed renting.
The fix isn't a new policy. It is making the exception cheap. Someone has to own the path that puts a workload where it belongs, so that choosing it is ordinary rather than a small act of courage. A default only stays a default while going the other way stays easy.