An SMS policy is the set of seven optional rules an account attaches to every phone lookup it runs — the countries it sends to or never sends to, the line types it refuses, the risk signals that block whenever they fire, a ceiling on the risk score, whether a live check must have reached the handset, and whether a number its suppression list holds as opted out is refused — from which Spaw answers ok_to_send on each response, with blocked_by naming the rule that decided. It turns a 49-field answer into the one boolean a verification step branches on before it pays to send a code.
What Spaw answers
A number that is not valid is blocked first and always, with blocked_by: invalid. Otherwise the rules are applied in a fixed order: an opt-out (opted_out, when the account's suppression list holds the number as opted out and the rule is on), the country (country, which also blocks a number with no country when an allow-list is set), the line type (line_type; fixed_line_or_mobile can never be blocked, because the North American plan does not say which of the two a number is), the first blocked signal in the published weights' order, the score ceiling (risk_score), and last the live-check requirement (unreachable when the network could not reach the handset, unconfirmed when no live check answered). Until an account sets a policy the defaults apply: fictional, disposable, reported_abuse, reported_abuse_widely and premium_rate block, so does any score over 60 and so does an opt-out, every country and line type is allowed, and no live check is required. A sender of one-time codes may switch the opt-out rule off, because an opt-out from marketing does not always forbid a verification code and the person typing the number may be its owner asking for one again. The policy endpoints or the SMS policy tab on the phone page change them for every member of the account, and single lookups, batches, bulk runs, monitors and the browser endpoint all apply the stored policy. A number served from the account's suppression list on a batch, bulk or monitored run answers blocked_by: suppressed.
What it does not mean
ok_to_send is a fraud and deliverability decision computed from the answer and the account's rules. It is not consent to message anyone and not a do-not-call scrub: neither is part of the answer, and both stay the sender's obligation. A country allow-list is the first control against SMS pumping to destinations a business never serves, and it is a business choice about where you send, not a verdict that a country's numbers are fraudulent. The policy is not the score either: the weights stay published and recomputable, and the policy only says which of them the account refuses to send past.