While I applaud the spirit of that question, it does have two sub-questions that people are alternately answering. To me, the two questions are:

 - What do I do with a user who is violating our AUP?
  - Alternate: What do I do with a user who is violating *our badly worded* AUP?
 - Why does my AUP have to harsh my squee? All I'm doing is looking at icanhazcheeseburger and surfing cosplay pictures from SDCC! That doesn't harm anyone! {1}

The first question has a pretty simple response, and that's "respond according to your AUP." Alert their supervisor, alert HR, and alert my supervisor are all valid responses depending on the organization in question. If this is the question being asked, it shouldn't be hard to distil up a good canonical answer. 

The second question is more topical on security.stackexchange.com, since that's an *IT Polciy* issue with significant inputs from the "defend the network" side of the house. Yes, we here on SF are often the engineers who put in things like web-filters but we're generally not the ones advocating their usage (see the comment-thread on the above question for proof of that).

The alternate wording version of the first question is trickier since it drifts back into the IT-policy realm again. If your AUP is short and sweet, like, "Don't do bad stuff, or we'll do something about it," you're in for a lot of back-room lawyering. "Bad" for one manager may be "accessing espn.com", where another manager may see bad as, "You can surf porn so long as no one can see or hear you do it." Long and specific AUPs are enforceable, short common-sense ones aren't.

Dealing with a possible violation of a badly worded AUP as a system administrator is hard and entirely dependent on the organization you're working in. This is the typical, "it depends," answer, and such questions aren't a good fit here. Attempting to get a broken AUP fixed skirts topicality here, and falls under the kind of internal policy advocacy that mid-level and sr-level sysadmins just do as part of their job.

Because the wording of the question lends itself to a policy-based answer, and most of the answers are focusing on policy, this is not topical on SF. Before http://security.stackexchange.com/ was around I'd actually have argued in favor of this question being topical. If it was rephrased into more of a "how do I handle an AUP violation" question, that I see as topical here. This isn't.

{1} Okay, maybe this question got a little example-heavy specific.