The policy document is not Xml encoded and is hosted on a http endpoint accessible from the API Management service.