You don't need an explicit policy to allow it (putting it in writing would be stupid). There's plenty of ways to effectively allow it without saying it, like no

You don't need an explicit policy to allow it (putting it in writing would be stupid). There's plenty of ways to effectively allow it without saying it, like not encouraging/deprioritizing projects that aim to crack down on this kind of behavior, effectively turning a blind eye to the bad content without ever explicitly "allowing" it so they retain plausible deniability when confronted.