That's my exact point. A policy isn't random but created for an effect. As an examnple: If an HN disclosure leaks passwords and email addresses into the publi

That's my exact point. A policy isn't random but created for an effect. As an examnple: If an HN disclosure leaks passwords and email addresses into the public domain, imposing a policy control is _meant_ to have the effect that such a disclosure would not happen again, or if it does to have a limited scope.