# Document-Only Policy

> Expressing security policy only as prose documentation, so it cannot be enforced automatically and drifts from what the system does.

Record: `lex:document-only-policy`
Kind: anti-pattern
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Canonical: https://banes-lab.com/ontology/lexicon#lex-document-only-policy

## category

- [Security Privacy Compliance](https://banes-lab.com/records/lex-category/security-privacy-compliance.md)

## referenced-by

- [Policy as Code](https://banes-lab.com/records/arch/policy-as-code.md)