Write a test, and fix bugs thus found. Also let's regularise semantics, and not let admins create policies for vhosts they haven't got permissions for. That makes policies a bit more like exchanges and queues.