actually return the auth policy