The intended model is that reusable policy automatically allows routine ones, denies the prohibited ones, and asks for approval only for a small set of higher risk actions maybe(that should hopefully reduce the approval fatigue).