In addition to package the policy file within a the war-agent, it should be possible to proided the policy by more dynamic means. E.g. lookup in LDAP or via an upload over an MBean (with local storage on the agent side and passwort protected after the first upload)