Policies tell employees what the rules are. Scenarios and near misses teach them what the rules are for.

https://www.securitymagazine.com/articles/102707-train-for-the-gray-zone-security-awareness-needs-a-simulator