don't default to DummyAuthPolicy!