Before any request arrives, the policy and its rules are defined, enabled, and persisted. This is the governance baseline — everything that follows is measured against it.