...

It is possible to define policies directly in Spring configuration of client and service as jaxws feature. CFX CXF will recognize and use configured WS-Policies:
Client:

...

1. Get policy from external location and build it for current message.
2. Parse WS-Policy XML using Neethi library.
3. Store result Policy object into PolicyConstants.POLICY_OVERRIDE message content property.
   Important is that this custom policy interceptor is called before CXF PolicyInInterceptor or PolicyOutInterceptor. Than CXF will automatically recognize Policy stored into this property and use it with highest priority.

...

1. Provide Assertion Builder class for custom assertion implementing AssertionBuilder<T> interface.
   Interface type can be Element, XMLStreamReader or OMElement.
   Interface contains two methods: build() and getKnownElements().
   Implementation of build() method should construct Assertion from the incoming type. It can be PrimitiveAssertion (without attributes or child elements), NestedPrimitiveAssertion (without attributes but with nested policy element) and JaxbAssertion (assertion described by any XML schema).
   getKnownElements() method must return QNames of assertion elements from which assertion can be built.
2. Implement policy interceptor provider class extending AbstractPolicyInterceptorProvider class. The main task of policy interceptor provider is to say which interceptors must be activated for specified policy assertion. Policy interceptor provider constructor gives assertions QNames as argument of super constructor and adds corresponded interceptors using getters:

public class AuthorizationInterceptorProvider extends AbstractPolicyInterceptorProvider {
    private static final long serialVersionUID = -5248428637449096540L;
    private static final AuthorizationInInterceptor IN_AUTHZ_INTERCEPTOR = new AuthorizationInInterceptor();
    private static final AuthorizationInInterceptor OUT_AUTHZ_INTERCEPTOR = new AuthorizationOutInterceptor();
    
    private static final Collection<QName> ASSERTION_TYPES;
    static {
        ASSERTION_TYPES = new ArrayList<QName>();
        ASSERTION_TYPES.add(AuthorizationConstants.AUTHORIZATION_ASSERTION);
    }

    public AuthorizationInterceptorProvider() {
        super(ASSERTION_TYPES);
        getInInterceptors().add(IN_AUTHZ_INTERCEPTOR);        
        getOutInterceptors().add(OUT_AUTHZ_INTERCEPTOR);        
    }
}

Assertion builder and policy interceptor provider can be registered using CXF bus extension mechanism: just create a file META-INF/cxf/bus-extensions.txt containing the following:

org.company.AuthorizationInterceptorProvider::true
org.company.AuthorizationAssertionBuilder::true

Boolean value at the end specifies lazy loading strategy.
CXF automatically recognizes the assertion builder and policy interceptor provider and store them into registries: AssertionBuilderRegistry and PolicyInterceptorProviderRegistry. Since CXF 2.6.0 it is possible to register multiple interceptor providers for single assertion.

How and where CXF processes policies

...

1. Check message property PolicyConstants.POLICY_OVERRIDE.
2. If PolicyConstants.POLICY_OVERRIDE contains policy, it will be taken for further processing.
3. If property is empty, policy will be asked from ServiceModel. Here CXF loads policies attached to WSDL or provided via Spring configuration.
4. If any policy on step 2 or step 3 is found, EffectivePolicy object will be created. Appropriate WS-policies will be merged for the current message and built into Neethi Policy object.
5. All interceptors registered for result policy assertions in PolicyInterceptorProviderRegistry will be added to message interceptor chain.

...