It comes from a commandfile like https://github.com/drush-ops/drush/blob/8.x/examples/policy.drush.inc