The policy checker employs two files. Role_definition.xml defines what and how VMs a role is allowed to operate. User_definition.xml defines what roles are available to a user. Operations are currently represented by numbers. They are defined in src/xr_internal.h in libvirt part, though it is hardly readable.