Policies are organizational scar tissue. They are codified overreactions to situations that are unlikely to happen again. They are collective punishment for the misdeeds of an individual. This is how bureaucracies are born. No one sets out to create a bureaucracy. They sneak up on companies slowly. They are created one policy--one scar--at a time. So don't scar on the first cut. Don't create a policy because one person did something wrong once. Policies are only meant for situations that come up over and over again.