No, it's not "regulatory policy". It's been done entirely with some combination of secret "Security Directives" and "rulemaking by press release". As the article and the linked references explain, the TSA never issued any regulations, published any of the required notices, or obtained any of the approvals that would have been required even if Congress had passed an (unconstitutional) authorizing statute (which it didn't).