It's true that policy file in drush prevents sql-sync from local to prod?
Yes this is still true you can find the relevant snippet in the drush source code:

/**
 * Implement of drush_hook_COMMAND_validate().
 *
 * Prevent catastrophic braino. Note that this file has to be local to the machine
 * that intitiates sql-sync command.
 */
function drush_policy_sql_sync_validate($source = NULL, $destination = NULL) {
  if ($destination == '@prod') {
    return drush_set_error(dt('Per examples/policy.drush.inc, you may never overwrite the production database.'));
  }
}


You should include the policy.drush.inc in your .drush folder usually located in the users home folder.