It is important to separate the establishment of security policy from the mechanisms one might use to implement or enforce a particular security policy. For example, one might decide that it will be the policy to not allow access to a certain building after 11 p.m. on weekdays. A mechanism for implementing this policy might involve the installation of door locks on all entry points and providing staff which will lock the doors promptly at 11 p.m. on weekdays.
All too often, in the realm of computer security, security policy is decided by available hardware mechanisms rather than first deciding on policy and then designing a mechanism which will be used to implement the policy.