I would disagree about security policies not benefitting from a minimal approach. If they're exhaustive and tedious to read, then they won't be read or understo

I would disagree about security policies not benefitting from a minimal approach. If they're exhaustive and tedious to read, then they won't be read or understood by the people who's decisions they're supposed to govern. Attempting to exhaustively enumerate the situations to which a policy could apply is a losing strategy. Making it as simple as possible for a person to know "what should I do here?" or "am I allowed to do this?" should be the ultimate goal.