This code modifies POST request type, each of them will need to specify an array of needed policies, that will be checked before accessing endpoint. An empty array means that this endpoint doesn't need acknowledgment or information about a missing acknowledgments will be attached to the response later on. Looks like other handlers, e.g. for GET requests don't need to check for policies, there is no need to complicate this because this change will still make users unable to use the app without accepting what's needed.
Context in ENG-2363.