Policy often causes more harm than good, is slow to update, exemptions are harder still to manage, measuring compliance at scale is near on impossible. Throwing some curly braces at a problem is not the solution. How do we fix it?