> The file can be created by cf-agent (or any other CFEngine component that reads policy files)

No, the daemons ``cf-execd``, ``cf-monitord``, ``cf-serverd`` explicitly *don't* create it.