This paper presents a novel approach to update a Mandatory Access Control policy on a distributed architecture, without relying on a central component. The two main features of this approach are: 1) updates are performed locally, on each node of the distributed architecture, and 2) all updates are locally checked against a common metapolicy, which specifies what part of the policy each node can update. Thus, there is no need for a central component, and still the policy update is controlled. This local approach provides better fault-tolerance and allows a given node to react to malicious activities detected locally. The metapolicy is shared by all nodes and relies on the notions of types, roles, users and security context. It contains modification rules that specify how the MAC policy can be modified in a given security context. This approach is developed as a joint research project with INRIA and FT R&D, called ACI SATIN, where verification techniques are proposed to verify that the distributed modifications cannot violate the required security properties.