We should wrap this whole thing in a `begin`/`ensure` block to make sure that the policy and group are destroyed.