There are essentially two schools of thought when it comes to rules.

The first is "rule of law" where it's important what the rules are. You need good people with knowledge of what's actually happening on the ground to be the ones who make the rules, and then the rules are strictly enforced and if that leads to a bad outcome it means the rules are deficient and there is a meaningful process for addressing that, which results in a change to the rules to prevent the bad outcome from happening in the future.

The second is "CYA" where the purpose of rules is to make prohibitions as many and broad as possible so that if anything bad happens or you have a dispute with someone you can pin a violation on them, and then the rules are ignored whenever that isn't the objective.

The best organizations use only the first system, but this is rare. If you make rules according to the first system and the way you enforce them is according to the second system, you have a minor problem with under-enforcement. If you use the second system entirely, you're going to have major problems with office politics and morale. But the worst is when the people at the top are making the rules in expectation of using the second system without noticing that someone in the middle is actually enforcing them.