add pdns_control policy