One directory per system: catalog/<your-system>/policy.yaml plus a four-sentence STORY.md. Reviewed by a steward like any policy change (a policy change is a governed event). In the Fall release this folds into the Umbrella-GovOps catalog and gains UCID crosswalks.