Detection scope

Where do you define managed policy?

Pick your layer. That layer and every layer above it are in scope: a write there either changes your policy or displaces it. Layers below cannot override you.

Note Watch for a policyHelper key appearing in any in-scope source. Once registered, the helper's output never touches disk, so the effective configuration stops being auditable from the filesystem.