move to an obfuscated variable name for role policy and ensure it exists during initialize
use a method not hard-coded value for role policy