Fixes T9019. Pretty much ripped from D14467. I added the "policy hint" stuff so that you can create a project with this policy immediately.
I really dislike how the "hint" code works, but we almost never need to use it and the badness feels fairly well-contained.
Also pick up a quick feedback fix from D14863.