reading the policy on the backend