I think your confusion stems from misunderstanding a few terms. For what its worth, there is a lot of confusion around these terms.
A Policy Suite is a grouping of specific algorithms for the sake of providing specific security services.
For example, an IPsec Policy Suite specifies 3 services:
Which means you could specify these three protocols and have everything you need for an IPsec Policy Suite: AES, SHA1-HMAC, ESP
The issue is, Symmetric Encryption requires a Secret Key. HMAC, also requires a secret key. Both of these keys need to be stored somewhere. The construct which stores both the Policy Suite and all necessary keys, is known as a Security Association.
So in short, a Policy Suite is something like AES, SHA1-HMAC, ESP, and a Security Association is a Policy Suite and all necessary keys. When two peers have identical SA's, they have everything they need to speak securely to one another -- an agreement on which protocols to use (Policy Suite) and identical secret keys.
IPsec creates two, unidirectional Security Associations, based upon a single Policy Suite (i.e, set of protocols). The only thing that makes one IPsec SA different from the next, are the secret keys used within the specific protocols.
This is by design. This way, if someone successfully brute forces one set of keys, they can only decrypt the data in one direction.
ISAKMP, for instance, creates a single security association (ie, set of keys within a matching policy suite) that is used to protect data in both directions (bidirectional).
For more information about how the keys are generated in IPsec and ISAKMP, see this answer.
Disclaimer: Some of the links above include links to my personal blog. My blog is not monetized. There are no ads. There is no mandatory e-mail capture. The links are provided purely because I think the content will help you understand more thoroughly the answer provided.