The correct way to build policies while also maintaining flexibility is NOT to grant exceptions, but rather to collect requests to an exception and then only change the policy once you’ve built up enough critical mass.
In other words, you should ALWAYS follow the policy. If the policy doesn’t work, change the policy. If the policy works, make sure people can deal with the fact that there will always be exceptions, and that having a policy is still better than not having a policy, or having a policy that’s not followed consistently.