To my mind, adding a new field to policy_templates.json would seem like the easiest way to implement this.

Julian: do you want to take a stab at this? If no, should this go in the general "unassigned for now" bucket to be picked up down the road?

I can own that one no problem. I guess the idea is to add this new field and a presubmit that enforces it for newly added policies. We can prepopulate it with "Unknown" for all existing ones and maybe update a small list of clear cases but unlikely all policies.