issue #7: auth policy from DB