experimenting with domain policy