fix return code
split up start_transient_scope into several functions
move hierarchy around
restore device policy support