Imagine you're managing a building where every floor has its own fire code, written by a different committee, in a different language, with no shared evacuation map. That's GenAI policy enforcement today. The alignment team writes behavioral norms in RLHF reward signals. The security team writes access control lists. The compliance team writes natural-language usage policies. None of these groups talk to each other, and when a fire starts — a jailbreak, a data leak, a hallucinated legal opinion — nobody knows whose code applies. Nathalie Baracaldo's paper, a companion to her USENIX Security 2026 Enigma talk, attempts something unglamorous but essential: she proposes a methodology for systematically dissecting how GenAI applications define and enforce policy across the entire stack. The core claim is that 'policy' means fundamentally different things to different practitioners — alignment researchers, security engineers, compliance officers, application developers — and these semantic gaps produce fragile, siloed enforcement that fails under real-world pressure. The paper surveys approaches 'found in the wild,' spanning alignment-time interventions (RLHF, constitutional AI, safety fine-tuning), inference-time guardrails (input/output classifiers, prompt injection detectors), and system-level access controls (rate limiting, role-based permissions, audit logging). What Baracaldo highlights is that these layers rarely compose cleanly. A model aligned to refuse harmful requests can still be jailbroken if the guardrail layer has gaps, and the access control layer may not even know what the alignment layer considers harmful. The architectural insight is that GenAI policy enforcement currently lacks a shared ontology. Traditional software security has decades of formalized policy languages (XACML, OPA/Rego, SELinux policies) with well-defined semantics. GenAI policy is still in its pre-formal era — policies are expressed as natural language guidelines, reward model preferences, system prompts, or classifier thresholds, with no common grammar between them. This is not just an inconvenience; it's a compliance liability. The paper's 'good, bad, and ugly' tour is taxonomic rather than empirical. This is a position paper and survey, not an experiment. There are no new benchmarks, no head-to-head comparisons of enforcement mechanisms, no quantitative measurements of policy violation rates across approaches. The value here is conceptual: naming the problem space clearly enough that others can build on it. The recommendations and call to action are directional — the community needs unified policy frameworks, composable enforcement layers, and shared evaluation criteria. For practitioners building GenAI applications today, the immediate takeaway is sobering: if your policy enforcement strategy treats alignment, guardrails, and access control as independent problems, you have gaps you haven't tested for. The paper doesn't tell you exactly how to close those gaps, but it gives you a map of where they are. That's the precondition for everything else. The honest limitation is scope. This is a survey-and-framework paper from a single author, positioned as a conference talk companion. It opens a door more than it walks through it. The real test will be whether the taxonomy proposed here becomes the shared language the field adopts, or whether it remains one more dialect in the tower.
