https://sterlingphoenix.com/blog/ai-policy-vs-operating-controls/