To configure vulnerability policies, you can consider the following three options: setting the output verbosity for blocked requests, applying the policy only when a vendor fix is available, and setting individual grace periods for each severity level. Output verbosity for blocked requests helps in understanding and troubleshooting why requests are blocked. Applying the policy only when a vendor fix is available ensures that actionable remediation steps can be taken. Providing individual grace periods for each severity level allows for a tailored approach in managing vulnerabilities based on their criticality.