*8148* introduce workflow stage access policy