Seems like `ENFORCE_PASSWORD_POLICY` would be a better name.