The SPWebApplication object has a Policies property containing a collection of
SPPolicy objects that represent the web  Application Policies. You can find an
explanation including sample code for adding  a policy  here:

msdn.microsoft.com/.../...oint.administration.sppo\
licycollection.aspx

Once you've got the collection it operates the same as adding custom security to
an object, but uses slightly different classes.