Fix policy to include token