having just looked at it, it appears its a graph-like structure but with policy as distinct objects instead of on relationships like we do for caveats