How to reduce risk with automated policy enforcement