Policies do work if you have a process to enforce those policies. Without policy how do you define the process? "Good intentions never work, you need good mechanisms to make anything happen." http://nickfoy.com/blog/2018/4/7/good-intentions-dont-work

By designing systems that encourage or enforce the correct action.