Adds note about policy needed for batch dr token (#12767)

website/content/api-docs/system/license.mdx

@@ -81,10 +81,10 @@ $ curl \
 ~> This API is deprecated as of Vault 1.8 and will be removed in a future version of Vault.
 Please use [license autoloading](/docs/enterprise/license/autoloading) instead.
 
-This endpoint is used to install a license into Vault.  The license will be 
-replicated to the Vault instances within the targeted cluster, but will not 
-replicate the license to a [performance replication](/docs/enterprise/replication) cluster. To license a 
-performance replication cluster, this must be run against a Vault instance within that cluster.  
+This endpoint is used to install a license into Vault.  The license will be
+replicated to the Vault instances within the targeted cluster, but will not
+replicate the license to a [performance replication](/docs/enterprise/replication) cluster. To license a
+performance replication cluster, this must be run against a Vault instance within that cluster.
 
 | Method | Path           |
 | :----- | :------------- |
@@ -101,6 +101,13 @@ Note that this is the legacy mechanism for providing a DR operation token. It is
 equally valid to provide the DR operation token in the `X-Vault-Token` header, as
 with a regular vault token.
 
+If you are using a batch `dr_operation_token`, note you will need to add the following to the token's policy
+
+```# Manage license for DR Secondary
+path "sys/replication/dr/secondary/license" {
+capabilities = ["update"]
+}```
+
 ### Sample Payload
 
 ```json