Towards guardrails, not guidelines: a policy framework for powerful AI systems