This part just really gets me.
There is no way to audit such ad hoc workflows that traverse devices and don't need to go through a common network. Without auditing, you can neither assure compliance, nor really manage security. Ultimately, we'll have to let go of those notions for the vast majority of data and workflows, using other means to validate access and information checkin/checkout and worrying less about what happens in between.
How can you get away with this in any organization that has any kind of over site?