policy enforced by accident

an operational behavior that happens to enforce a rule becomes the rule's only enforcement, whether or not anyone chose that — hyrum's law with yourself as the dependent party. a written policy can be "enforced" solely by an implementation detail of a component chosen for other reasons; replacing that component then repeals the policy with no diff line saying so.

the audit question that catches it: for each written policy, what code enforces it, and does that code know it's doing policy? if the answer is "a side effect," the policy has no owner. the durable fixes are the obvious ones — enforce the rule in code that names it, at more than one layer, and test the policy itself (a test of the incidental behavior keeps passing while the door stands open).

measured example: pub-search's months-old ban on bridged content was enforced only by a strict commit verifier's rejection of non-canonical repos; a pipeline replacement with a lenient fallback re-admitted ~20,000 documents a day until the ban was made explicit at every layer.

sources

• pub-search — docs/exclusions.md, commit a6f2bda
• hyrum's law