It is not a rule, but rather part of each carrier's safety & security policy (or not). Once part of that policy, it is enforced as an FAA rule.
All it takes is for an FAA inspector to have cited a carrier and the word will have spread and the policy will be enforced for some period of time.