Policies that govern allocation of spectrum access credentials are established. The policies are configured to implement regulatory rules governing spectrum use in a geographic area. Policy establishment includes selecting, from a collection of predetermined general policy constructs that are generic to plural regulatory domains, general policy constructs to transform into protection instances. Policy parameter inputs are applied to policy parameter fields of the selected general policy constructs to establish the protection instances, the protection instances specify how regulatory rules are applied in the geographic area. Protection data values are applied to protection data fields of the protection instances to create instances of policies that are specific to the geographic area according to incumbent spectrum use in the geographic area.