That's not a reasonable requirement. You simply can't write rules that apply to every aspect of day to day life that may be relevant for situations you may have

That's not a reasonable requirement. You simply can't write rules that apply to every aspect of day to day life that may be relevant for situations you may have not even anticipated might happen. You can try, and that's typically what organizational policies aim to do. But once you've set a policy, pretending like it's some sort of infallible divine guidance is asking for failure. Good security policy needs to always be reacting, always considering whether the rules they've set are still a net gain in the security of the system, given that they're operating in a real world of real people with real behaviors that may not have been accurately predicted.