All policy is configured by the zone administrator and enforced by the zone's primary name server. Policy dictates the authorized actions that an authenticated principal can take. Policy checks are based on the principal and the desired action, where the principal is derived from the message signing key and applied to dynamic update messages signed with that key. The server's policy defines criteria which determine if the key used to sign the update is permitted to perform the requested updates. The policy is fully implemented in the primary zone server's configuration for several reasons.
Policy is only relevant in the server applying it, so there is no reason to expose it.
Finally, a change in policy or a new type of policy should not affect the DNS protocol or data format, and should not cause interoperability failures. A common practice would be to restrict the permissions of a principal by domain name. That is, a principal could be permitted to add, delete, or modify entries corresponding to one or more domain names. The addition of SIG records can lead to attacks resulting in additional workload for resolvers, and the deletion of SIG records could lead to extra work for the server if the zone SIG was deleted. Note that these records are not forbidden, but not recommended for normal users.