use aa-enforce here instead?