A governance policy is an approved statement of required behavior and accountability for identities and access. It may cover ownership, least privilege, request approval, lifecycle deadlines, review frequency, exceptions, separation of duties and evidence retention.
Good governance policies are translated into testable rules and measurable controls rather than remaining only as prose documents.