new defensive check for trying to modify policies on a nested container. Closes GH-284