Policy should be included with the software package I don't agree with this. When you do this, any malicious package can just ship a new policy that allows the

Policy should be included with the software package I don't agree with this. When you do this, any malicious package can just ship a new policy that allows the maliciousness it's planning to do. By all means, split up the mega-policy into usable app-sized chunks, but shipping the policy in the same rpm as the application is self-defeating.