Add sepolicies for decrypt primary user