See, your examples are just GREAT to prove MY point.
Let's take the first one: forcing password policy change through the system every x months. First, let us note that's a policy. Then, imagine the GM calls the guy in charge of the AD policy and says: "look, I'm sick of this shit, undo it now so I don't need to change it for 5 years." In the absence of an approved policy the IT guy MUST do it. Even with a policy, if he's weak or stupid, he will do it. So the lack of usable control is not with the user that would have to change it because the policy says so, but with the guy that is supposed to enforce it because it's a policy.
What you wanted to say is that the controls that rely on the machine (the so called automated controls) are BETTER, but please be aware that you ALWAYS, and i mean ALWAYS, have a PROCESS component and a PEOPLE component. If the process involving your technology is bad or the people operating your technology are stupid then your technology is USELESS. And is bound to fail.
Please, for the sake of your future in the area of IT Security, remember this: "People, Processes, Technology". Always together, always with the same weight when concerned about the usefulness of a certain security policy, measure or control.
I can take any of the other examples YOU GAVE and prove you're wrong, dead wrong, but I am confident that you got the point by now.
Again, sorry for my demeanor in the previous post and I really hope your pride will not blind you on this topic.
regards