Security policies are created in AOT\Security\Policies. You need developer rights to do so.
Security policy groups are created by typing the name (free text) in the property window of the security policy. The new name will appear in the lookup next time you do a lookup in the property.