A sending policy is the set of three optional rules an account attaches to every email lookup it runs — the signals that block whenever they fire, a ceiling on the risk score, and a floor for the mailbox confidence of an unconfirmed mailbox — from which Spaw answers ok_to_send on each response, with blocked_by naming the rule that decided. It turns a 46-field answer into the one boolean most integrations actually branch on.
What Spaw answers
An undeliverable verdict is always blocked, whatever the policy says. Otherwise the rules are applied in a fixed order: the first blocked signal in the published weights' order, then the score ceiling, then the confidence floor. Until an account sets a policy the defaults apply — the disposable, typo-squat, parked-domain, blocklisted-network and no-reply signals block, and so does any score over 60 — and the policy endpoints or the Sending policy tab change them for every member of the account.
What it does not mean
The policy is not the score. The weights stay published and recomputable, and reading the flags is still the right thing to do when a form needs more than one decision; the policy exists so that the common case needs one field.