UI for rep:cugPolicy?

Is there a UI for adding, removing or changing CUG authorization policies? Documentation makes zero reference to rep:cugPolicy,

  https://helpx.adobe.com/experience-manager/6-3/sites/administering/using/closed-user-groups.html

It does talk about Java code to manage the policies. Is that really how we're doing it now? Pushing code changes to manage CUG authorization policy. To be clear, I am not asking about the authentication requirement which has a UI in the pages advanced tab. It seems rep:cugPolicy are protected so the nodes cannot be deleted and recreated in /crx/de. nor will /crx/de allow me to update the values in rep:principalNames. Which is crazy since I just copied and pasted the node to begin setting a new authorization policy.