anybody built an open-source compliance policy before?

Good question! #general has about twice as many members, so you might find better luck cross-posting over there. We're not super strict about "post in the right channel or else, grrrrr" so it should be fine. And if not, blame me. :-)