It's like a lot of things... process orientation and discipline early on go a long way to keeping things sane. There are nice techniques for debugging policies as well (login_as_user functions, etc). We write pgTap tests for everything, and that REALLY helps.