So where and how is Policy defined? Once it's been defined where and how is it stored? These are both entirely under the control of the Client Solution. In terms of definition and storage, the only thing that is important to FESF is that the Client Solution promptly responds to callbacks from FESF when FESF asks it for Policy decisions.
A Solution's Policy could be defined by a GUI program or even an MMC snap-in developed as part of the Solution. Because the factors that are used to define Policy are determined by the Client Solution, FESF does not provide any standard mechanism for defining Policy.
Some Solutions may store the Policy information in a proprietary Policy server. Others might encode the information and store it in the Active Directory, using custom extensions of the AD schema. Because the format and content of Policy is entirely defined by the Client Solution, FESF does not require (or provide) any standard location for Policy storage.