use un restrictive policy