Banks grant access one system and one action at a time. Software should earn it the same way. Ask any vendor what it has shown you with read access alone.
A policy states an obligation, not the evidence that it was met, so people translate it case by case. Write one rule as a check and see what is missing.
