*8148* introduce base policy for PKP-wide roles