"Policies" in this case are system wide configurations. The idea is you can set at the system level things like "do not use md5" and be reasonably confident tha

"Policies" in this case are system wide configurations. The idea is you can set at the system level things like "do not use md5" and be reasonably confident that nothing on the system is going to ignore that. This has nothing to do with export control.