yah. we could use another rule. we could save the old policy somewhere and reapply it (or revert to a previous version). I'm not totally sure the best way to go about it right now. 

It seems like using a new policy is probably a good idea, so that when you lock the object you lock even the people that were in hte policy out, but i'm not sure all the use cases here.