A typical access control policy should include a glossary of terms, policy scope, policy purpose, access control rules, and contact information for the person /department responsible for generating and maintaining the policy.