Policy answers two questions: when to scan, and what counts as fail. Too tight freezes the pipeline; too loose empties the gate.