issue #7: "auth policy" from DB