We don't allow AGPL.

AGPL is very easy to control for the external facing stuff, but not the internal stuff.

For example, based on how it defines remote network interaction, it doesn't differentiate internal or external users. So if we used AGPL in internal systems that Temps, vendors, and contractors had access to, we'd end up owing all the temps, vendors, and contractors source code to the internal system, regardless of what other NDA's or anything else were in place (it's well settled that you can't contract around or NDA folks into giving up GPL/AGPL rights)

We aren't willing to take this risk (and i'd bet most companies that are doing it don't realize this is an issue :P)