The policy document is not XML encoded and is hosted on a HTTP endpoint accessible from the API Management service.