episode 14 additions - restricting user access via policies