Determining why a policy object is out of compliance