Default policy suitable for most enterprise deployments. Annual rotation with 90-day backward compatibility.