For the Mule 4 custom-policy development model represented by this question, the policy's runtime behavior is implemented in an XML template, while the policy's configurable parameters and metadata are described in a YAML configuration file.
The XML template uses Mule's XML configuration language and policy-specific elements such as http-policy:proxy, http-policy:source, http-policy:operation, and http-policy:execute-next. In this scenario, the developer can place the header-token inspection and validation behavior in this implementation layer. The accompanying YAML file exposes configurable policy parameters to API Manager and provides the metadata needed for policy configuration.
MuleSoft's custom-policy development reference identifies an XML template and YAML file as core policy project artifacts; the complete project additionally contains its POM, Mule artifact descriptor, and any optional resources.
A ZIP file is not the source artifact pair used to define the policy. Similarly, a generic JSON properties file is not a replacement for the implementation template in this Mule 4 custom-policy model.
Thus, among the available combinations, the XML policy template together with the YAML configuration file is the required pair.
Reference topics: Mule Gateway custom policies; XML policy templates; YAML policy configuration; HTTP Policy Transform Extension.
Official documentation: https://docs.mulesoft.com/mule-gateway/policies-custom-mule-4-reference
===============================================================
