One policy. Every site.

Set the rules once. Push them everywhere. Override per-site when reality calls for it. Audit the whole chain.