not an abstract policy document but a concrete, implementable plan for how VitraMed should govern data going forward, incorporating everything she'd learned.