must give a URI policy, even if it's empty