What prevents people from not doing what the policy says? Since neither "paper doc" policy nor "code policy" actually constrains humans from trying to exploit or work around the system, oversight and compliance still seem like messy human functions. Does this just become "more structured compliance documentation"? Which sounds nice, but not dramatically different.

And on the creation side, what prevents political fights over what goes into the "code policy" of exactly the same sort that lead to compromises or oddities in paper policies?