Piecemeal policies and fragmented oversight has led to concerning transactions by San Jose’s credit card-holding employees.