original_policy can be NULL (as it's not always returned by browser)