Update notes for submitted changes

* Fix missing policy enforcement in CFN API