[Permission Target Name] createPolicy.{policy type} Granting this permission enables code to obtain a Policy object. Malicious code may query the Policy object to determine what permissions have been granted to code other than itself. [What the Permission Allows] 
Getting an instance of a Policy implementation from a provider