Or, to state it another way, if the given policy_file is actually a symlink, do we want to use the directory in which we find the symlink or the directory in which the file to which it links (as identified by realpath) actually resides ?
I am inclined to use the raw path, hence the directory in which the symlink resides, not the one into which it points: that shall let an admin have a stock policy file that they symlink from various places, that adapts its work to fit the place from which it's symlinked by using $(sys.local_libdir).