created policy, can only delete your own container