added ops (read/write) to policy rules