auto deny shouldnt create a policy