Policies solve the distribution problem of standards: rules pasted into system prompts drift as prompts are copied and edited, and rules in a handbook are wherever the agent is not. A policy lives in one place, is assigned to the workflows it governs, and arrives inside the active step's payload.
The operational consequence is instant propagation: edit the policy once and every run in flight picks it up at its next step. No template surgery, no redeploy, no memo.
Policies inform; they do not block. The blocking primitive is the gate. A governance design that is honest about that split puts rules in policies and stop-points in gates, and never claims one does the other's job.
A good policy is short, specific and scoped. "Commit messages follow the conventional format", assigned to the workflows that commit, beats a page of standards attached everywhere. Scope keeps each step small, so the rule the agent needs is not buried among rules that do not apply to what it is doing. Policies also give a team one place to answer which rules the agents follow: read the policy list, not every prompt.