With enough detail, policies can cover every scenario.
She said that her central security group had recognized that policies, no matter how detailed, could never address every scenario that might lead to a security incident.