requests can optionally be exempt to access policy