Sector policy templates: tell us where yours is wrong #117

examples/policies/ has a starting-point policy for nine sectors —
devops, payments, e-commerce, insurance, healthcare, legal, security, government, hr. Each is
headed "Starting point on the v0.1 kernel. Adapt before use." and each was written by someone
who is not a practitioner in that sector.

If you work in one of these domains, the useful contribution is telling us where the template
is wrong. No code required; a comment is a complete contribution.

The three questions

1. What consequential action is missing? Something an agent in your domain would plausibly
   do that the template has no entry for.
2. What threshold is wrong? An amount, a count, a window that would either wave through
   something serious or stop routine work dead. The second failure mode is the one that gets a
   guard switched off.
3. What would this refuse that it should not? A template that blocks ordinary work is a
   template nobody keeps.

Rules for a change to one

• v0.1 primitives only. These are starting points, not a product surface.
• No compliance or standards claims. Not in the YAML, not in a comment, not in the PR
  description — not "PCI", not "HIPAA-aligned", not "meets". This is enforced by a lint and by
  the project's standards rule: integrate first, map second, never claim compliance. A template
  that names a regulation as its authority is the one thing that will not be merged.
• Cite where an expectation comes from if it has a public source, as a fact about the source
  and not as a claim about the file.

The deeper sector packs — control registries, approver roles, data scope — are a separate track
that runs on the v0.6 primitives and is authored and reviewed in a documented way. This issue is
only about the templates that ship today.