I can hardly imagine how our technical jargon will change in the next 250 years. If you'll permit me…
What it means to execute code on the "bare metal" has changed over time. If you track its usage on HN, it is now common for programmers to use this to describe running a program outside of a Docker container or hypervisor/VM, but still atop an OS.
(I personally think this change in meaning is silly, but my feelings on this matter don't matter.)
Interpreting security policy making use of this "bare metal" term is now tricky. Choice #1 is to interpret the policy in the context in which it was written. Choice #2 is to attempt to interpret the policy in the context of how the term is now used.
(The best choice is, of course, to rewrite the security policy in question to address the change in definition, but for the sake of argument let's consider this to be too impractical to even consider.)
Let's assume that the 1996 policy in question is: "No company-written code that interacts with the Internet shall run on bare metal."
If we strictly interpret the policy in the context in which it was written, then we're in a pickle. Agner's hand-rolled x86_64 HTTP server is permitted. It runs atop GNU/Linux, so it's not freestanding and therefore isn't a "bare metal" program.
On the other hand, if we determine that the modern use of "bare metal" is compatible with what the authors of the policy intended, then the security team is clear to insist that Agner run his HTTP server within Docker, for instance.