Fix the mess in the workflow policy restriction framework. Now it's
consistently something which works rather than a complex of stuff which
half-works.