Add authorization policies