Refine policy interceptor to only skip sub-rpc policy checks for services

...s