As an alternative, perhaps allow for policy settings to inherit. So a specific override can be applied to a user or group, but also inherit from the global level. This would remove the need to edit every policy if a common change is required across all policies - we could just edit the top level global and know it's updating through all other policies