[fedora-virt] Some USB devices are blocked by host policy

I'm using Spice and want to share a USB device on workstation with a VM running on another physical host. The filters are all set up for the VM in its domain XML. The Spice "Select USB devices for redirection" dialog shows the device I want to redirect. However, all the USB devices are greyed out and Alert text says, "Some USB devices are blocked by host policy". My understanding, from the doc <https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/...;, is that the following XML needs to be configured on the "host physical machine's domain XML" which I am interpreting as the workstation, although it could be the hypervisor host, to unblock the USB device: <redirfilter> <usbdev class='0x08' vendor='0x0951' product='0x1625' version='2.0' allow='yes'/> <usbdev allow='no'/> </redirfilter> Either way, I cannot figure out what the name or location of the file where this XML would go, let alone find a complete schema or example of what the file would look like. Has anyone else done this? Please... <gasp> Help!