assign users to policies