A security architect is documenting the layers of a defense-in-depth strategy for a new office. She wants to categorize each control by type. The company enforces a written acceptable use policy that all employees must sign, requires badge readers at every door, and runs endpoint antivirus on all workstations. When classifying the signed acceptable use policy, which category of security control does it represent?