Why have policies even if you aren't going to enforce them much

Recently I wrote about how firewalls are porous now and said at the end that this didn't mean you should simply accept the situation and do nothing. One set of things you can do is take technical steps to make it harder, such as blocking some things, but another set of things is to have policies even if you can't enforce them (bearing in mind that people-hostile policies are a bad idea in general and that your people are showing you want they want).

The start of why I think you should consider policies is a Socratic question: if you don't want your people to do something, how are they going to find that out? My answer is that policies are a communication with people. They set baseline expectations, to say both what you're okay with and what you're not okay with. Without communication on this you can't expect people to read your mind, and what system administrators think is common sense often isn't to normal people (this applies both to what you don't want and what you're okay with). As part of that, if people don't understand why certain procedures and processes exist, they're prone to bypassing them because it seems both harmless and useful. So your policies should explain not just what but why.

(Many years ago I briefly worked on the IT side of a supermarket and read a number of its trade publications. One bit that's stuck with me ever since was a story about a cashier that hadn't been taught why you keep the cash drawer closed as much as possible so they left it open while they were doing something because it was convenient, and a passer-by took the opportunity to snatch some money. This wasn't presented as the cashier's fault but instead as a fault in the training because the training covered the what but not the why.)

One consequence of this is that your policies should be clear and have examples. You don't have to be exhaustive, but if you write your policies in the usual general way without examples, you're counting on people to read your mind and understand where what they're about to do falls. Some of them will be wrong, because reading your mind is hard, and you can't be surprised about that.

(Here I'm talking about policies aimed at your own people within an organization. Policies that will apply to your customers or the general public are a more complicated situation that I'm not qualified to write about.)

Another thing policies do is they create permission. They create permission for people to act in ways that you've explicitly said are okay in your policies, so people don't have to be nervous, and they give you permission to act if something is (clearly) outside of your policies, something you've said not to do (ideally explicitly and specifically, not generally and vaguely). The corollary to this is that if you want the freedom to react to something without a big internal discussion, you should write it into your policy.

(You can always react to things in emergency situations or unusual situations, but it may require a big discussion either beforehand to make up your mind, or afterward to justify your emergency actions. Writing a policy is one way to have the discussion in advance.)

I feel strongly that regular system policies are not laws or contracts and so they shouldn't be written like them. Laws and contracts are written in a pretty specific way that's attempting to withstand adversarial challenges. Your acceptable usage policies within your organization are hopefully not going to be subject to adversarial challenge (in court or otherwise) and so you shouldn't write them that way; you should write them to be clear, not legally precise. (This may not apply, but if it doesn't, you need legal advice and input on your policy documentation.)

PS: In large organizations (such as universities), your local policies are also in practice a communication with people around your (sub-)group, both your chain of management and other parts of the organization. My view is that what your policies communicate here is not necessarily your intentions but your aspirations. You should probably pick aspirations that you really mean and would be happy (or at least okay) if they actually came to pass, since if they become possible to realize, outside parties may try to hold you to them.