Every decision was made under some specific policy
If authorization policy lives as a mutable configuration that gets edited directly, there's no reliable way afterward to answer a question like 'what did policy allow at the moment this specific decision was made' — the current state of the table doesn't tell you what it looked like an hour, a day, or a month ago. Versioning policy as an append-only sequence of named, timestamped revisions makes that question answerable: each decision can reference the exact policy version that governed it.
This matters most during an investigation. If a decision later turns out to have been wrong, the first question is usually whether the policy at the time actually permitted it, or whether the enforcement point deviated from policy. Without a version history, that distinction is often unrecoverable after the fact.
Rollback as a first-class operation, not a manual re-edit
A policy change that turns out to be wrong — too permissive, too restrictive, or simply broken in some untested case — needs a fast way back to the last known-good state. If reverting means manually reconstructing the previous configuration from memory or scattered notes, the time to recovery during an incident is far longer than it needs to be. Treating each policy revision as a addressable, restorable version makes rollback a single deliberate action instead of a reconstruction exercise.