Most teams start with a rule that lives in someone’s head: don’t ship to production on a Friday without telling Priya. It works until Priya is on holiday, or until there are four Priyas, or until an auditor asks you to prove it happened.
Encode the rule
A policy states who must approve what, under which conditions. It does not name a person if it can name a role, and it never depends on memory.
Segregation of duties is the case that matters most: the person who authored a change should not be the person who approves it. That is trivial to state and almost impossible to enforce socially — someone will always be in a hurry.
What you get back
The interesting benefit is not compliance. It is that the rule becomes reviewable. When a policy is a file, you can argue about it in a pull request rather than in an incident retrospective.
What it does not solve
Policies do not make judgement calls. They can require two approvals from the platform team; they cannot tell you whether this particular change is a good idea at 5pm. Keep the humans for that.