Auditors do not want your policy. They want an artefact.

Disclosure: I work on an access tool (Tessera), mentioned once at the end. Everything before that is...