policy

a business rule
reactive (vs proactive)
doesn't guarantee how quickly or strongly it's enforced
- ie it breaks, then something fixes it
- compensating actions may be required
can contain things outside an aggregate, as the aggregate doesn't control all parts of an operation