This looks slightly odd as it seems that you are adding policies *within* the larger "for" loop which is capturing the list of polices.

It's slightly worrisome, but I haven't been able to test it.  It just seems like it'd be safer to have an "assignPermissions(context,dso,policy)" to add policies one-by-one as they are encountered in the "for" loop.  As it is, I worry whether this code is going to function properly when multiple policies are encountered (esp. if one policy is an embargo policy and one is not)