It's slightly more complicated than that, but the FA was largely correct.

Each carrier files its safety and security policy with FAA. Once accepted by FAA, the carrier's failure to enforce its policy becomes a violation.

It's up to AA to have such a rule, but once it does, it's effectively "the law". A pretty sensible one too.