I am assuming we are talking here about CA SSO.
CA SSO OOB provide XPSExport and XPSImport.
We create objects manually in one pre-designated lower environment e.g. Dev.
Then using the tool we automate moving policies into higher environments e.g. to QA and to Production.