Governance fails in a very specific way. Someone writes an excellent policy. It is reviewed, approved, and filed. Everyone agrees it is correct. And then nothing in the actual environment changes, because the policy lives in a document and nowhere else. Governance that is only documentation does not govern anything. It describes an intention.
I have read a lot of these documents. They are usually well written and genuinely sensible. The problem is never the content. It is the distance between the document and the place where work actually happens.
A policy that is not enforced is a suggestion
The moment a rule depends on people remembering to follow it, it stops being governance and becomes a hope. People are busy, defaults are strong, and the path of least resistance wins almost every time. If the correct behavior is harder than the incorrect one, the document loses.
Real governance closes that gap by moving the rule into the system, where the correct behavior becomes the default and the incorrect one becomes difficult or impossible.
Where governance has to live
In a Microsoft environment, this means the policy has to show up in the places that shape behavior:
- Azure Policy that enforces standards at deployment, not in a review later
- Conditional Access that makes the access rule a runtime decision, not a guideline
- Purview labels and controls that act on data instead of describing how it should be handled
- Access reviews that actually expire permissions rather than recommending someone should
When governance lives here, it stops depending on memory and goodwill. It becomes part of how the environment behaves.
Documentation still matters, in its place
None of this means documentation is useless. It records intent, explains reasoning, and aligns people. But it is the description of governance, not the governance itself. The enforcement has to live in the system. The document explains why the system behaves as it does.
The test I apply is simple. If everyone forgot this policy existed tomorrow, would the environment still enforce it. If the answer is yes, you have governance. If the answer is no, you have a document about governance, and those are not the same thing. The work is moving the rule from the page into the place where the work happens.