https://sterlingphoenix.com/ai-policy-vs-operating-controls/