You could check the lsof (list open files) command, like sudo lsof -c syspolicyd to see what files are touched by it.