policy checker and unit test for it