Too many question marks
Replace DefaultPolicy with DenyPolicy, adds AllowPolicy
Prevents executing object methods as Policy rules