Your $xml variable is an object (not an array) and I suspect that it may need to be converted to an array, then used to set the fields of the Policy individually. I don't think you'll need json_encode() because the 'data' member is probably already JSON and it's the only JSON value in a Policy. You may also need to create a Policy Template and use its ID for the 'template' field of the Policy.
Here's what the Policy object looks like:
http://bobsguides.com/modx-object-quick-reference.html#modAccessPolicy.
You might also look at the code of the NewsPublisher snippet. The third and fourth files
here have code to create a Policy and Policy Template.
If you have a code editor that will let you run and debug php scripts (e.g., PhpStorm), you'll save a lot of time if you write the code in it and step through it to see what you're getting until you can get things in the correct form.