Policy must be evaluated at the boundaries where permissions, data, and operations move, with enforcement actions including allow, log observation, warn or request approval, route to an approved destination, redact or restrict sensitive content, and deny the operation.